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Abstract 

We study the security of communication between a single transmitter and multiple 
receivers in a broadcast channel in the presence of an eavesdropper. Characterizing 
the secrecy capacity region of this channel in its most general form is difficult, because 
O . the version of this problem without any secrecy constraints, is the broadcast channel 

with an arbitrary number of receivers, whose capacity region is open. Consequently, 
^ , to have progress in understanding secure broadcasting, we resort to studying several 

0\ \ special classes of channels, with increasing generality. As the first model, we consider 

the degraded multi-receiver wiretap channel where the legitimate receivers exhibit a 
' degradedness order while the eavesdropper is more noisy with respect to all legitimate 

CN ' receivers. We establish the secrecy capacity region of this channel model. Secondly, 

we consider the parallel multi-receiver wiretap channel with a less noisiness order in 
. each sub-channel, where this order is not necessarily the same for all sub-channels. 

Consequently, this parallel multi-receiver wiretap channel is not as restrictive as the 
^ , degraded multi-receiver wiretap channel, because the overall channel does not exhibit a 

H ' degradedness or even a less noisiness order. We establish the common message secrecy 

capacity and sum secrecy capacity of this channel. Thirdly, we study a special class of 
parallel multi-receiver wiretap channels and provide a stronger result. In particular, we 
study the case with two sub-channels two users and one eavesdropper, where there is a 
degradedness order in each sub-channel such that in the first (resp. second) sub-channel 
the second (resp. first) receiver is degraded with respect to the first (resp. second) 
receiver, while the eavesdropper is degraded with respect to both legitimate receivers 
in both sub-channels. We determine the secrecy capacity region of this channel, and 
discuss its extensions to arbitrary numbers of users and sub-channels. Finally, we focus 
on a variant of this previous channel model where the transmitter can use only one 
of the sub-channels at any time. We characterize the secrecy capacity region of this 
channel as well. 
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29127, and was presented in part at the 42nd Asilomar Conference on Signals, Systems and Computers, 
Pacific Grove, CA, October 2008 [1]. 
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1 Introduction 



Information theoretic secrecy was initiated by Wyner in his seminal work [2] where he intro- 
duced the wiretap channel and established the capacity-equivocation region of the degraded 
wiretap channel. Later, his result was generalized to arbitrary, not necessarily degraded, 
wiretap channels by Csiszar and Korner [3]. Recently, many multiuser channel models have 
been considered from a secrecy point of view [4-21]. One basic extension of the wiretap 
channel to the multiuser environment is secure broadcasting to many users in the presence 
of an eavesdropper. In the most general form of this problem (see Figured]), one transmitter 
wants to have confidential communication with an arbitrary number of users in a broadcast 
channel, while this communication is being eavesdropped by an external entity. Our goal 
is to understand the theoretical limits of secure broadcasting, i.e., largest simultaneously 
achievable secure rates. Characterizing the secrecy capacity region of this channel model in 
its most general form is difficult, because the version of this problem without any secrecy 
constraints, is the broadcast channel with an arbitrary number of receivers, whose capac- 
ity region is open. Consequently, to have progress in understanding the limits of secure 
broadcasting, we resort to studying several special classes of channels, with increasing gener- 
ality. The approach of studying special channel structures was also followed in the existing 
literature on secure broadcasting [9,10]. 

Reference [10] first considers an arbitrary wiretap channel with two legitimate receivers 
and one eavesdropper, and provides an inner bound for achievable rates when each user 
wishes to receive an independent message. Secondly, [10] focuses on the degraded wiretap 
channel with two receivers and one eavesdropper, where there is a degradedness order among 
the receivers, and the eavesdropper is degraded with respect to both users (see Figure [2] for 
a more general version of the problem that we study). For this setting, [10] finds the secrecy 
capacity region. This result is concurrently and independently obtained in this work as a 
special case, see Corollary [1], which is also published in a conference version in [1]. 

Another relevant work on secure broadcasting is [9] which considers secure broadcasting 
to K users using M sub-channels (see Figure |3]) for two different scenarios: In the first 
scenario, the transmitter wants to convey only a common confidential message to all users, 
and in the second scenario, the transmitter wants to send independent messages to all users. 
For both scenarios, [9] considers a sub-class of parallel multi-receiver wiretap channels, where 
in any given sub-channel there is a degradation order such that each receiver's observation 
(except the best one) is a degraded version of some other receiver's observation, and this 
degradation order is not necessarily the same for all sub-channels. For the first scenario, [9] 
finds the common message secrecy capacity for this sub-class. For the second scenario, where 
each user wishes to receive an independent message, [9] finds the sum secrecy capacity for 
this sub-class of channels. 

In this paper, our approach will be two- fold: First, we will identify more general channel 
models than considered in [9,10] and generalize the results in [9,10] to those channel models. 
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Figure 1: Secure broadcasting to many users in the presence of an eavesdropper. 
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Figure 2: The degraded multi-receiver wiretap channel with a more noisy eavesdropper. 



and secondly, we will consider somewhat more specialized channel models than in [9] and 
provide more comprehensive results. More precisely, our contributions in this paper are: 

1. We consider the degraded multi- receiver wiretap channel with an arbitrary number 
of users and one eavesdropper, where users are arranged according to a degraded- 
ness order, and each user has a less noisy channel with respect to the eavesdropper, 
see Figure [21 We find the secrecy capacity region when each user receives both an 
independent message and a common message. Since degradedness implies less noisi- 
ness [3], this channel model contains the sub-class of channel models where in addition 
to the degradedness order users exhibit, the eavesdropper is degraded with respect to 
all users. Consequently, our result can be specialized to the degraded multi-receiver 
wiretap channel with an arbitrary number of users and a degraded eavesdropper, see 
Corollary [1] and also [1]. The two-user version of the degraded multi-receiver wiretap 
channel was studied and the capacity region was found independently and concurrently 
in [10]. 

2. We then focus on a class of parallel multi- receiver wiretap channels with an arbitrary 
number of legitimate receivers and an eavesdropper, see Figure [3], where in each sub- 
channel, for any given user, either the user's channel is less noisy with respect to 
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Figure 3: The parallel multi-receiver wiretap channel. 

the eavesdropper's channel, or vice versa. We establish the common message secrecy 
capacity of this channel, which is a generalization of the corresponding capacity result 
in [9] to a broader class of channels. Secondly, we study the scenario where each 
legitimate receiver wishes to receive an independent message for another sub-class of 
parallel multi-receiver wiretap channels. For channels belonging to this sub-class, in 
each sub-channel, there is a less noisiness order which is not necessarily the same for 
all sub-channels. Consequently, this ordered class of channels is a subset of the class 
for which we establish the common message secrecy capacity. We find the sum secrecy 
capacity for this class, which is again a generalization of the corresponding result in [9] 
to a broader class of channels. 

3. We also investigate a class of parallel multi- receiver wiretap channels with two sub- 
channels, two users and one eavesdropper, see Figure |H For the channels in this class, 
there is a specific degradation order in each sub-channel such that in the first (resp. 
second) sub-channel the second (resp. first) user is degraded with respect to the first 
(resp. second) user, while the eavesdropper is degraded with respect to both users in 
both sub-channels. This is the model of [9] for K = 2 users and M = 2 sub-channels. 
This model is more restrictive compared to the one mentioned in the previous item. 
Our motivation to study this more special class is to provide a stronger and more 
comprehensive result. In particular, for this class, we determine the entire secrecy 
capacity region when each user receives both an independent message and a common 
message. In contrast, [9] gives the common message secrecy capacity (when only a 
common message is transmitted) and sum secrecy capacity (when only independent 
messages are transmitted) of this class. We discuss the generalization of this result to 
arbitrary numbers of users and sub-channels. 

4. We finally consider a variant of the previous channel model. In this model, we again 
have a parallel multi-receiver wiretap channel with two sub-channels, two users and 
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Figure 4: The parallel degraded multi-receiver wiretap channel. 

one eavesdropper, and the degradation order in each sub-channel is exactly the same 
as in the previous item. However, in this case, the input and output alphabets of 
one sub-channel are non-intersecting with the input and output alphabets of the other 
sub-channel. Moreover, we can use only one of these sub-channels at any time. We 
determine the secrecy capacity region of this channel when the transmitter sends both 
an independent message to each receiver and a common message to both receivers. 



2 Degraded Multi-receiver Wiretap Channels 

We first consider the generalization of Wyner's degraded wiretap channel to the case with 
many legitimate receivers. In particular, the channel consists of a transmitter with an input 
alphabet x E X, K legitimate receivers with output alphabets yk G 3^^, k = 1, . . . , K, and an 
eavesdropper with output alphabet z E Z. The transmitter sends a confidential message to 
each user, say wy, G to the fcth user, in addition to a common message, G Wq, which 
is to be delivered to all users. All messages are to be kept secret from the eavesdropper. The 
channel is assumed to be memoryless with a transition probability ?/2, • • • , Vk-, z\x). 

In this section, we consider a special class of these channels, see Figure [2], where users 
exhibit a certain degradation order, i.e., their channel outputs satisfy the following Markov 
chain 

X^Yk^...^Yx (1) 

and each user has a less noisy channel with respect to the eavesdropper, i.e., we have 

I{U;Yk)>I{U;Z) (2) 

for every U such that U X {Yk,Z). In fact, since a degradation order exists among 
the users, it is sufficient to say that user 1 has a less noisy channel with respect to the 
eavesdropper to guarantee that all users do. Hereafter, we call this channel the degraded 
multi-receiver wiretap channel with a more noisy eavesdropper. We note that this channel 
model contains the degraded multi-receiver wiretap channel which is defined through the 
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Markov chain 

X^Yk^...^Y^^Z (3) 

because the Markov chain in ([3]) imphes the less noisiness condition in ([2]). 

A (2"-^'', 2"^^, . . . , 2"'^''^', n) code for this channel consists ol K + 1 message sets, Wfc = 
{1, . . . , 2"-f^4, = 0, 1, . . . , ir, an encoder / : Wo x . . . x Wi^ ^ A'", isT decoders, one at 
each legitimate receiver, gu '■ yk ^ VVo x Wfc, k = 1, . . . ,K. The probability of error is 
defined as = max^^i ...^i^- Pr [gk(Yj^) ^ (Wq, Wk)]. A rate tuple {Rq, Ri, . . . , Rk) is said 
to be achievable if there exists a code with lim^^oo = and 

\im -H{S{W)\Z'') > y Rk, W S{W) (4) 

k&S(W) 

where S(W) denotes any subset of {Wo,Wi, . . . ,Wk}- Hence, we consider only perfect 
secrecy rates. The secrecy capacity region is defined as the closure of all achievable rate 
tuples. 

The secrecy capacity region of the degraded multi-receiver wiretap channel with a more 
noisy eavesdropper is given by the following theorem whose proof is provided in Appendix lA.li 



Theorem 1 The secrecy capacity region of the degraded multi- receiver wiretap channel 
with a more noisy eavesdropper is given by the union of the rate tuples {Rq, Ri, . . . , Rk) 
satisfying 

e e 

Ro + J2Rk<J2l{Uk;Yk\Uk-i)-I{Uf,Z), i = l,...,K (5) 

k=l k=l 

where Uq = 0, Uk = X, and the union is over all probabihty distributions of the form 

p{ui)p{u2\ui) . . .p{uK-l\uK~2)p{x\uK-l) (6) 

Remark 1 Theorem [1] implies that a modified version of superposition coding can achieve 
the boundary of the capacity region. The difference between the superposition coding scheme 
used to achieve ([5]) and the standard one [22] is that the former uses stochastic encoding 
in each layer of the code to associate each message with many codewords. This controlled 
amount of redundancy prevents the eavesdropper from being able decode the message. 

As stated earlier, the degraded multi-receiver wiretap channel with a more noisy eaves- 
dropper contains the degraded multi-receiver wiretap channel which requires the eavesdrop- 
per to be degraded with respect to all users as stated Q. Thus, we can specialize our 
result in Theorem [1] to the degraded multi- receiver wiretap channel as given in the following 
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corollary whose proof is provided in Appendix IA.2I 



Corollary 1 The secrecy capacity region of the degraded multi-receiver wiretap channel is 
given by the union of the rate tuples {Rq, Ri, . . . , Rk) satisfying 

R^ + Y,Rk<Y,^(Uk;Yk\Uk-uZ), i=l,...,K (7) 

k=l k=l 

where Uq = (j), Uk = X, and the union is over all probability distributions of the form 

p('Ui)p(u2|mi) . . .p{uk-i\uk-2)p{Auk-i) (8) 

We acknowledge an independent and concurrent work regarding the degraded multi- 
receiver wiretap channel. Reference [10] considers the two-user case and establishes the 
secrecy capacity region as well. 

So far we have determined the entire secrecy capacity region of the degraded multi- 
receiver wiretap channel with a more noisy eavesdropper. This class of channels requires a 
certain degradation order among the legitimate receivers which may be viewed as being too 
restrictive from a practical point of view. Our goal is to consider progressively more general 
channel models. Towards that goal, in the next section, we consider channel models where 
the users are not ordered in a degradedness or noisiness order. However, the concepts of de- 
gradedness and noisiness are essential in proving capacity results. In the next section, we will 
consider multi-receiver broadcast channels which are composed of independent sub-channels. 
We will assume some noisiness properties in these sub-channels in order to derive certain ca- 
pacity results. However, even though the sub-channels will have certain noisiness properties, 
the overall broadcast channel will not have any degradedness or noisiness properties. 



3 Parallel Multi-receiver Wiretap Channels 

Here, we investigate the parallel multi-receiver wiretap channel where the transmitter com- 
municates with K legitimate receivers using M independent sub-channels in the presence of 
an eavesdropper, see Figure [31 The channel transition probability of a parallel multi- receiver 
wiretap channel is 

M 

5 VKm ) I Xm 

) (9) 

m=l 

where Xm G '^m is the input in the mth sub-channel where is the corresponding channel 
input alphabet, i/km £ 3^fcm (resp. Zm G Zm) is the output in the kth user's (resp. eavesdrop- 
per's) mth sub-channel where (resp. Zm) is the kth user's (resp. eavesdropper's) mth 
sub-channel output alphabet. 
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In this section, we investigate special classes of parallel multi-receiver wiretap channels. 
These channel models contain the class of channel models studied in [9] as a special case. 
Similar to [9], our emphasis will be on the common message secrecy capacity and the sum 
secrecy capacity. 

3.1 The Common Message Secrecy Capacity 

We first consider the simplest possible scenario where the transmitter sends a common con- 
fidential message to all users. Despite its simplicity, the secrecy capacity of a common 
confidential message (hereafter will be called the common message secrecy capacity) in a 
general broadcast channel is unknown. 

The common message secrecy capacity for a special class of parallel multi-receiver wiretap 
channels was studied in [9]. In this class of parallel multi-receiver wiretap channels [9], each 
sub-channel exhibits a certain degradation order which is not necessarily the same for all 
sub-channels, i.e., the following Markov chain is satisfied 

ywiil) ^ yni{2) ^ ■ ■ ■ ^ ^niiK+l) (10) 

in the Ith sub-channel, where (5^7r;(i), ^^1(2), ■ ■ ■ , ^7r;(_ff+i)) is a permutation of (Yu, . . . , Yki, Zi). 
Hereafter, we call this channel the parallel degraded multi-receiver wiretap channeo Al- 
though [9] established the common message secrecy capacity for this class of channels, in 
fact, their result is valid for the broader class in which we have either 

Xi ^ Yui ^ Zi (11) 

or 

Xi^Zi^ Yu (12) 

valid for every Xi and for any (A;, /) pair where k G {1, . . . , K}, I G {1, . . . , M}. Thus, it 
is sufficient to have a degradedness order between each user and the eavesdropper in any 
sub-channel instead of the long Markov chain between all users and the eavesdropper as in 

dinD. 

Here, we focus on a broader class of channels where in each sub-channel, for any given 
user, either the user's channel is less noisy than the eavesdropper's channel, or vice versa. 
More formally, we have either 

I{U;Yki)> IiU;Zi) (13) 

^In [9], these channels are called reversely degraded par slUcI channels. Here, we call them parallel degraded 
multi-receiver wiretap channels to be consistent with the terminology used in the rest of the paper. 
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or 

I{U;Y,i)<I{U;Zi) (14) 

for all U ^ Xi (Yki,Z) and any {k,l) pair where k G {1,...,K}, I G {1,...,M}. 
Hereafter, we call this channel the parallel multi-receiver wiretap channel with a more noisy 
eavesdropper. Since the Markov chain in ( JTOl) implies either (fT3l) or (JT4l) . the parallel multi- 
receiver wiretap channel with a more noisy eavesdropper contains the parallel degraded 
multi-receiver wiretap channel studied in [9]. 

A (2"-^, n) code for this channel consists of a message set, Wo = {1, . . . , 2"^}, an encoder, 
/ : Wo — > X ... X A'jjj, decoders, one at each legitimate receiver gu : yui x . . . x y^M 
Wq, /c = 1, . . . , i^. The probability of error is defined as = maxk=i,...,K Pr Wko 7^ 
where Wko is the fcth user's decoder output. The secrecy of the common message is measured 
through the equivocation rate which is defined as ^H^WqIZ]", . . . , Z^^). A common message 
secrecy rate, R, is said to be achievable if there exists a code such that lim^^oo -Pg" = 0; 

hm -H{Wo\Z^,...,Zl,)>R (15) 

n^oo n 

The common message secrecy capacity is the supremum of all achievable secrecy rates. 

The common message secrecy capacity of the parallel multi-receiver wiretap channel 
with a more noisy eavesdropper is stated in the following theorem whose proof is given in 
Appendix IB.li 

Theorem 2 The common message secrecy capacity, Cq, of the parallel multi-receiver wire- 
tap channel with a more noisy eavesdropper is given by 

M 

Co = max min V [/(X,; Ym) - /(X,; Zi)]^ (16) 

ft;=l,...,iv ' • 
1=1 

where the maximization is over all distributions of the form p{xi, . . . , xm) = Y[t=iP{^i)- 

Remark 2 Theorem [2] implies that we should not use the sub-channels in which there is 
no user that has a less noisy channel than the eavesdropper. Moreover, Theorem [2] shows 
that the use of independent inputs in each sub-channel is sufficient to achieve the capac- 
ity, i.e., inducing correlation between channel inputs of sub-channels cannot provide any 
improvement. 

As stated earlier, the parallel multi-receiver wiretap channel with a more noisy eavesdrop- 
per encompasses the parallel degraded multi-receiver wiretap channel studied in [9]. Hence, 
we can specialize Theorem [2] to recover the common message secrecy capacity of the parallel 
degraded multi-receiver wiretap channel established in [9]. This is stated in the following 
corollary whose proof is given in Appendix IB.2I 
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Corollary 2 The common message secrecy capacity of the parallel degraded multi-receiver 
wiretap channel is given by 



M 

Co = max^jiiin^^ J(X/; Yfc/|Z;) (17) 

where the maximization is over all distributions of the form p{xi, . . . , xm) = Yli-LiPi^i)- 
3.2 The Sum Secrecy Capacity 

We now consider the scenario where the transmitter sends an independent confidential mes- 
sage to each legitimate receiver, and focus on the sum secrecy capacity We consider a class 
of parallel multi-receiver wiretap channels where the legitimate receivers and the eavesdrop- 
per exhibit a certain less noisiness order in each sub-channel. These less noisiness orders are 
not necessarily the same for all sub-channels. Therefore, the overall channel does not have 
a less noisiness order. In the Ith sub-channel, for all U —>■ Xi ^ {Yii, ■ ■ ■ , Yki, Zi)^ we have 

I{U; > I{U- y^,(2)) > . . . > I{U- r.Kif+i)) (18) 

where (1^7r;{i), ^7r,(2)5 • • • , ^7r,(E'+i)) is a permutation of {Yn, . . . , Yki, Zi). We call this channel 
the parallel multi-receiver wiretap channel with a less noisiness order in each sub-channel. 
We note that this class of channels is a subset of the parallel multi-receiver wiretap channel 



with a more noisy eavesdropper studied in Section 13.11 because of the additional ordering 
imposed between users' sub-channels. We also note that the class of parallel degraded multi- 
receiver wiretap channels with a degradedness order in each sub-channel studied in [9] is 
not only a subset of parallel multi-receiver wiretap channels with a more noisy eavesdropper 
studied in Section 13.11 but also a subset of parallel multi-receiver wiretap channels with a 
less noisiness order in each sub-channel studied in this section. 

A (2"-^i . . . , 2"'^'^ ,n) code for this channel consists of K message sets, Wk = {1, . . . , 2""'^*}, 
= 1, . . . , i^, an encoder, / : Wi x . . . x Wr — ^ x . . . x A"^, K decoders, one at each legit- 
imate receiver gk : yki x . . . x y^M — ^ VVfc, k = 1, . . . , K. The probability of error is defined as 
Pg" = maxfe=i /^Pr Wk ^ Wk where Wk is the kth user's decoder output. The secrecy is 
measured through the equivocation rate which is defined as ^H{Wi, . . . , Wk\Z^, . . . , Z'^). A 
sum secrecy rate, Rg, is said to be achievable if there exists a code such that lim„^oo Pe = 0, 
and 

lim -H{Wu . . . , Wk\Z^, . . . , ^m) > Rs (19) 

n^oo n 

The sum secrecy capacity is defined to be the supremum of all achievable sum secrecy rates. 

The sum secrecy capacity for the class of parallel multi-receiver wiretap channels with 
a less noisiness order in each sub-channel studied in this section is stated in the following 
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theorem whose proof is given in Appendix O 

Theorem 3 The sum secrecy capacity of the parallel multi-receiver wiretap channel with a 
less noisiness order in each sub-channel is given by 

M 

max^ [l{XuYp^)i)-I{Xi-Zi)Y (20) 
1=1 

where the maximization is over all input distributions of the form . . . , xm) = Y{u=i vi^i) 
and p{l) denotes the index of the strongest user in the /th sub-channel in the sense that 

I{U;Yu)<I{U-Y,,^i)i) (21) 

for all U Xi (Yi/, . . . , Yku Zi) and any k E {1, . . . , K}. 

Remark 3 Theorem [3] implies that the sum secrecy capacity is achieved by sending infor- 
mation only to the strongest user in each sub-channel. As in Theorem [2l here also, the use 
of independent inputs for each sub-channel is capacity-achieving. 

As mentioned earlier, since the class of parallel multi-receiver wiretap channels with a 
less noisiness order in each sub-channel contains the class of parallel degraded multi-receiver 
wiretap channels studied in [9], Theorem[3]can be specialized to give the sum secrecy capacity 
of the latter class of channels as well. This result was originally obtained in [9]. This is 
stated in the following corollary. Since the proof of this corollary is similar to the proof of 
Corollary [2], we omit its proof. 

Corollary 3 The sum secrecy capacity of the parallel degraded multi-receiver wiretap chan- 
nel is given by 

M 

maxJ2HXi;ypii)i\Zi) (22) 
1=1 

where the maximization is over all input distributions of the form p{xi, . . . ,xm) = Y[i=i p{^i) 
and p(Z) denotes the index of the strongest user in the Zth sub-channel in the sense that 

Xi ^ ^ Yki (23) 

for all input distributions on Xi and any A; G {1, . . . , K}. 

So far, we have considered special classes of parallel multi-receiver wiretap channels for 
specific scenarios and obtained results similar to [9] , only for broader classes of channels. In 
particular, in Section 13.11 we focused on the transmission of a common message, whereas in 
Section 13.21 we focused on the sum secrecy capacity when only independent messages are 
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transmitted to all users. In the subsequent sections, we will specialize our channel model, 
but we will develop stronger and more comprehensive results. In particular, we will let 
the transmitter send both common and independent messages, and we will characterize the 
entire secrecy capacity region. 

4 Parallel Degraded Multi-receiver Wiretap Channels 

We consider a special class of parallel degraded multi-receiver wiretap channels with two 
sub-channels, two users and one eavesdropper. We consider the most general scenario where 
each user receives both an independent message and a common message. All messages are 
to be kept secret from the eavesdropper. 

For the special class of parallel degraded multi-receiver wiretap channels in consideration, 
there is a specific degradation order in each sub-channel. In particular, we have the following 
Markov chain 

X, ^ Fn ^ Y2, ^ Z, (24) 

in the first sub-channel, and the following Markov chain 

X2 — > Y22 — ^ Y12 — > Z2 (25) 

in the second sub-channel. Consequently, although in each sub-channel, one user is degraded 
with respect to the other one, this does not hold for the overall channel, and the overall 
channel is not degraded for any user. The corresponding channel transition probability is 

P{yii\xi)p{y2i\yii)p{zi\y2i)p{y22\x2)p{yi2\y22)p{z2\yi2) (26) 

If we ignore the eavesdropper by setting Z\ — Z2 — 0, this channel model reduces to the 
broadcast channel that was studied in [23,24]. 

^ ^2"-'^, 2"^i, 2"-'^2^ codjs. for this channel consists of three message sets. Wo = {!,..., 
2"-^}, = {1, . . . , T'^i}, j = 1, 2, one encoder f : W0XW1XW2 ^ XJ" x X^, two decoders 
one at each legitimate receiver gj : x 3^"2 ~^ ^0 x Wj, j = 1, 2. The probability of error 
is defined as — maxj=i 2 

Pr [gjiYJl, YJ'2) ^ (W^o, VF,)] . A rate tuple (i?o, R2) is said to 
be achievable if there exists a code such that hm„_^oo -PJ* — 

\m,-E{s{yv)\zi,zi)> V \j siyv) (27) 

n— »oo Tl ' 

where SiyV) denotes any subset of {VFo, W^i, 1^2}- The secrecy capacity region is the closure 
of all achievable secrecy rate tuples. 

The secrecy capacity region of this parallel degraded multi-receiver wiretap channel is 
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characterized by the following theorem whose proof is given in Appendix ID.ll 



Theorem 4 The secrecy capacity region of the parallel degraded multi- receiver wiretap 
channel defined by fl26l) is the union of the rate tuples {Rq, Ri, R2) satisfying 



R^ < liUr, Yxx\Z^) + /(f/2; Yi2\Z2) (28) 

i?o < KUv. Y2x\Zx) + /(f/2; 1^221^2) (29) 

i?o + i?i < /(Xi; Fnl^i) + /(f/2; ^-121^2) (30) 

/?o + i?2 < /(X2; 1^221^2) + /(f/i; >^2l|^l) (31) 

i?o + + i?2 < /(Xi; Fnl^i) + /(t/2; l^i2|^2) + /(X2; r22|f/2, ^2) (32) 

i?o + + /?2 < /(X2; 1^221^2) + /(t/i; Y2x\Zx) + /(Xi; Fnlf/i, ^1) (33) 



where the union is over all distributions of the form p(mi, U2, X\, X2) = p(?^i, a;i)p(M2, a;2). 

Remark 4 If we let the encoder use an arbitrary joint distribution p(mi, xi, M2, 0:2) instead 
of the ones that satisfy p(ui, Xi, u^, X2) = p(mi, a;i)p(u2, X2), this would not enlarge the region 
given in Theorem HJ because all rate expressions in Theorem H] depend on either p(mi,xi) or 
'p{u2-,X'i) but not on the joint distribution ■p{u\^U2-,X\,X'i). 

Remark 5 The capacity achieving scheme uses either superposition coding in both sub- 
channels or superposition coding in one of the sub-channels, and a dedicated transmission in 
the other one. We again note that this superposition coding is different from the standard 
one [22] in the sense that it associates each message with many codewords by using stochastic 
encoding at each layer of the code due to secrecy concerns. 

Remark 6 If we set Zx = 2^ = 0, we recover the capacity region of the underlying broadcast 
channel [24]. 

Remark 7 If we disable one of the sub-channels, say the first one, by setting Yw = Y21 = 
Zi = 0, the parallel degraded multi-receiver wiretap channel of this section reduces to the 
degraded multi-receiver wiretap channel of Section [2l The corresponding secrecy capacity 
region is then given by the union of the rate tuples {Rq, Ri, R2) satisfying 

R^ + Ri<I{U2;Yi2\Z2) (34) 
Ro + Ri + R2< /(X2; F22|t/2, Z2) + I{U2-, Yu\Z2) (35) 

where the union is over all p{u2, X2)- This region can be obtained through either Corollary [1] 
or Theorem H] (by setting Yn = Y21 = Zi = (p and eliminating redundant bounds) implying 
the consistency of the results. 

Next, we consider the scenario where the transmitter does not send a common message, 
and find the secrecy capacity region. 
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Corollary 4 The secrecy capacity region of the parallel degraded multi-receiver wiretap 
channel defined through (l26l) with no common message is given by the union of the rate 
pairs (i?i,i?2) satisfying 



Ri < /(Xi; Fnl^i) + HU2; ^121^2) (36) 

R2 < I{X2; Y22\Z2) + I{U,; Y2i\Z,) (37) 

Ri + R2< /(Xi; Fnl^i) + /(f/2; Y^2\Z2) + /(X2; ¥22^2, ^2) (38) 

+ i?2 < /(X2; F22|^2) + I{Ui- Y2i\Zi) + /(Xi; rn|?7i, Zi) (39) 



where the union is over all distributions of the form p{ui)p{u2)p{xi\ui)p{x2\u2) . 

Proof: Since the common message rate can be exchanged with any user's independent mes- 
sage rate, we set Rq = a + (3, R[ = Ri + a, R'2 = R2 + P where a, /3 > 0. Plugging these 
expressions into the rates in Theorem H] and using Fourier-Moztkin elimination, we get the 
region given in the corollary. ■ 

Remark 8 If we disable the eavesdropper by setting Zu = Z22 = 0, we recover the capacity 
region of the underlying broadcast channel without a common message, which was found 
originally in [23]. 

At this point, one may ask whether the results of this section can be extended to arbitrary 
numbers of users and parallel sub-channels. Once we have Theorem HI the extension of the 
results to an arbitrary number of parallel sub-channels is rather straightforward. Let us 
consider the parallel degraded multi-receiver wiretap channel with M sub-channels, and in 
each sub-channel, we have either the following Markov chain 

Xi ^ Yu ^ Y21 ^ Zi (40) 

or this Markov chain 

Xi Y21 ^ Yu ^ Zi (41) 

for any / G {1, . . . , M}. We define the set of indices Si (resp. ^2) as those where for every 
/ G Si (resp. / G ^2), the Markov chain in (HOll (resp. in (HB ) is satisfied. Then, using 
Theorem |H we obtain the secrecy capacity region of the channel with two users and M 
sub-channels as given in the following theorem which is proved in Appendix ID.2[ 

Theorem 5 The secrecy capacity region of the parallel degraded multi- receiver wiretap 
channel with M sub-channels, where each sub-channel satisfies either ( l40l) or ( 14TI) is given 
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by the union of the rate tuples {Rq, Ri, R2) satisfying 

M 

Ro<J2^(Ui;Yn\Zi) (42) 

1=1 

M 

Ro<Y,^{Ui-Y2i\Zi) (43) 
1=1 

Ro + Ri< 5^ /(x^; yi^l^o + ^ /([//; ri/l^i) (44) 

leSi ieS2 

R0 + R2 <Y,HXi-^y2i\Zi) + J2HUi;Y,i\Zi) (45) 

ieS2 leSi 

Ro + Ri + R2<J2 ^(^'; ^I'l^') + E ^I'l^') + E ^^dt^/, (46) 

iGSi ieS2 i€S2 

Ro+Ri + R2<J2 ^(^'; ^2d^z) + 5^ /(t/^; ^2,1^0 + J2 H^f, yii\ui, zi) (47) 

ieS2 leSi leSi 

where the union is over all distributions of the form Yli^iPi'^i^ ^i)- 

We are now left with the question whether these results can be generalized to an arbitrary 
number of users. If we consider the parallel degraded multi-receiver wiretap channel with 
more than two sub-channels and an arbitrary number of users, the secrecy capacity region 
for the scenario where each user receives a common message in addition to an independent 
message does not seem to be characterizable. Our intuition comes from the fact that, as of 
now, the capacity region of the corresponding broadcast channel without secrecy constraints 
is unknown [25]. However, if we consider the scenario where each user receives only an 
independent message, i.e., there is no common message, then the secrecy capacity region 
may be found, because the capacity region of the corresponding broadcast channel without 
secrecy constraints can be established [25], although there is no explicit expression for it in 
the literature. We expect this particular generalization to be rather straightforward, and do 
not pursue it here. 



5 Sum of Degraded Multi-receiver Wiretap Channels 

We now consider a different multi-receiver wiretap channel which can be viewed as a sum 
of two degraded multi-receiver wiretap channels with two users and one eavesdropper. In 
this channel model, the transmitter has two non- intersecting input alphabets, i.e., X11X2 
with Xi n X2 — 0, and each receiver has two non-intersecting alphabets, i.e., 3^ji,3^j2 with 
yji n — for the jth user, j — 1, 2, and Zi, Z2 with Zid Z2 — ^ for the eavesdropper. 
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The channel is again memoryless with transition probabihty 



!p{yii\xi)p{y2i\yii)p{zi\y2i) if {x,yi,y2,z) e Xix x 3^21 x Zi 
Piy22\x2)piyi2\y22)piz2\yi2) a ix,yi,y2,z) e X2 X y2i X y22 y< Z2 (48) 
otherwise 

where x E X = Xi U X2, yj E yj = yji U 3^j2,J = 1,2 and z e Z = Zi U Z2. Thus, if 
the transmitter chooses to use its first alphabet, i.e., Xi, the second user (resp. eavesdrop- 
per) receives a degraded version of user I's (resp. user 2's) observation. However, if the 
transmitter uses its second alphabet, i.e., X2, the first user (resp. eavesdropper) receives a 
degraded version of user 2's (resp. user I's) observation. Consequently, the overall channel 
is not degraded from any user's perspective, however it is degraded from the eavesdropper's 
perspective. 

A (2"'^", 2"^\ 2"'^2, ra) code for this channel consists of three message sets, wq G Wq = 
{1, . . . , 2"-f^o}, Wj eWj = {!,..., 2"-f^^}, j = 1, 2, one encoder / : Wo x Wi x W2 ^ A'" and 
two decoders, one at each legitimate receiver, gj : 3^" Wq x Wj,j = 1,2. The probability 
of error is defined as = maXj=i^2Pr [9j0^j^) i^o^^j)]- A rate tuple {Rq, Ri, R2) is 
said to be achievable if there exists a code with lim„^oo = 

Urn -H(S(W)\Z'') > y R,, \f S(W) (49) 

jes{w) 

where S{W) denotes any subset of {Wq, Wi, 1^2 }• The secrecy capacity region is the closure 
of all achievable secrecy rate tuples. 

The secrecy capacity region of this channel is given in the following theorem which is 
proved in Appendix [El 

Theorem 6 The secrecy capacity region of the sum of two degraded multi-receiver wiretap 
channels is given by the union of the rate tuples {Rq, i?2) satisfying 



Ro < aI{Ui; Yi,\Zi) + aI{U2; Fi2|^2) (50) 

Ro < aI{Ui; Y2i\Zi) + aI{U2] F22IZ2) (51) 

R^ + Ri< aI{X,; Yn\Z,) + aI{U2; Fi2|^2) (52) 

Ro + R2< aliUi- Y2i\Zi) + aI{X2; ^221^2) (53) 

Ro + Ri + R2< aI{Xr, Y^^\Zr) + aI{U2\ Fial^a) + ^/(Xs; r22|f/2, ^2) (54) 

Ro + Ri + R2< aI{Ui; r2i|^i) + aI{X,; Yn\U,, Z,) + aI{X2; 1^221^2) (55) 



where the union is over all a G [0,1] and distributions of the form p(ui, M2, Xi, X2) = 

p{Ui,Xi)p{u2,X2). 

Remark 9 This channel model is similar to the parallel degraded multi-receiver wiretap 
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channel of the previous section in the sense that it can be viewed to consist of two parallel 
sub-channels, however now the transmitter cannot use both sub-channels simultaneously. 
Instead, it should invoke a time-sharing approach between these two so-called parallel sub- 
channels {a reflects this concern). Moreover, superposition coding scheme again achieves 
the boundary of the secrecy capacity region, however it differs from the standard one [22] in 
the sense that it needs to be modified to incorporate secrecy constraints, i.e., it needs to use 
stochastic encoding to associate each message with multiple codewords. 

Remark 10 An interesting point about the secrecy capacity region is that if we drop the 
secrecy constraints by setting Zi = Z2 = 4>, we are unable to recover the capacity region of 
the corresponding broadcast channel that was found in [24]. After setting Zi = Z2 = 0, we 
note that each expression in Theorem [6] and its counterpart describing the capacity region [24] 
differ by exactly h{a). The reason for this is as follows. Here, a not only denotes the time- 
sharing variable but also carries an additional information, i.e., the change of the channel 
that is in use is part of the information transmission. However, since the eavesdropper can 
also decode these messages, the term h{a), which is the amount of information that can be 
transmitted via changes of the channel in use, disappears in the secrecy capacity region. 

6 Conclusions 

In this paper, we studied secure broadcasting to many users in the presence of an eavesdrop- 
per. Characterizing the secrecy capacity region of this channel in its most general form seems 
to be intractable for now, since the version of this problem without any secrecy constraints, 
is the broadcast channel with an arbitrary number of receivers, whose capacity region is 
open. Consequently, we took the approach of considering special classes of channels. In 
particular, we considered degraded multi-receiver wiretap channels, parallel multi-receiver 
wiretap channels with a more noisy eavesdropper, parallel multi-receiver wiretap channels 
with less noisiness orderings in each sub-channel, and parallel degraded multi-receiver wire- 
tap channels. For each channel model, we obtained either partial characterization of the 
secrecy capacity region or the entire region. 

Appendices 

A Proofs of Theorem [1] and Corollary [1] 

A.l Proof of Theorem [1] 

First, we show achievability, then provide the converse. 
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A. 1.1 Achievability 

Fix the probability distribution as 

p{ui)p{u2\ui) . . .p{uk-i\uk-2)p{x\uk-i) (56) 

Codebook generation: 

• Generate 2"(^°+''^i+''^i) length-n sequences Ui through p{ui) = nr=i^'('"i.«) 

dex them as Ui{wo,Wi,Wi) where Wq G {l, . . . , 2"-^" j, wi G {l, . . . , 2"-^^ j and Wi G 
{l,...,2"^i}. 

• For each Uj_i, where j — 2,. . . , K—1, generate 2"^^^+^^^ length-n sequences Uj through 
p(uj|uj_i) = nr=i ^iid index them as Uj(wo, 'Ji'i, ■ ■ ■ , Wj, wi, . . . , wj) where 

G {1, . . . , 2"^^ } and G {1, . . . , 2^^-^^ }. 

• Finally, for each Uk-i, generate 2"^^^+^^^ length-n sequences x through p(x|ux-i) = 
YYi=iPi.^i\''^K,i) and index them as x{wo,Wi,...,WK,'Wi,---,yJK) where wk G 
{l,...,2"^^} and wk e {l, . . . , 2'*-^^}. 

• Furthermore, we set 

Ri = I{Ui;Z\Ui_,), i = l,...,K (57) 
where Uq = (j) and Uk — X. 
Encoding: 

Assume the messages to be transmitted are (wq, Wi, . . . , wk)- Then, the encoder ran- 
domly picks a set (wi, . . . , wk) and sends x(u'o, wi, . . . , w^, wi, • • • , wk)- 

Decoding: 

It is straightforward to see that if the following conditions are satisfied, 

i?o + i?i + ^i < /(C/i;^!) (58) 
Rj + < I{Uf r,|f/,-i), J = 2, . . . , X - 1 (59) 

i?i^ + ^K</(X;V'i^|^K-i) (60) 

then all users can decode both the common message and the independent message directed 
to itself with vanishingly small error probability Moreover, since the channel is degraded, 
each user, say the jth one, can decode all of the independent messages intended for the users 
whose channels are degraded with respect to the jth user's channel. Thus, these degraded 
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users' rates can be exploited to increase the jth user's rate which leads to the following 
achievable region 

i e. I 

i?o + l]i?, + l]i?, <l]/(f/,;>S|f^,-i), £ = i,...,ir (61) 
j=i j=i j=i 

where Uq = (p and Uk = X. Moreover, after eliminating {Rj^^_^ , f l6Tl) can be expressed as 

i?o + 5^i?, <5Z/(f/,;>Sl^j-i)-/(f/£;^), ^ = i,...,K (62) 

i=i i=i 

where we used the fact that 
^ t 

J2^i=Yl ^l^^-i) = ^(^1' ■■■^Uf,Z) = I{Uf, Z) (63) 

where the second and the third equalities are due to the following Markov chain 

Ui^ ...^ Uk-i ^X^Z (64) 



Equivocation calculation: 

We now calculate the equivocation of the code described above. To that end, we first 
introduce the following lemma which states that a code satisfying the sum rate secrecy 
constraint fulfills all other secrecy constraints. 

Lemma 1 If the sum rate secrecy constraint is satisfied, i.e., 

1 ^ 

-E[W^, W^i, . . . , Wk\Z^) >y^R,- en (65) 

j=0 

then all other secrecy constraints are satisfied as well, i.e.. 



^H{S{W)\Z^)> J2 R^-^n (66) 
where S{W) denotes any subset of {Wq, Wi, . . . , Wk}- 
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Proof: The proof of this lemma is as follows. 

-H(S(W)\Z'') = -H(S(W),S'(W)\Z") - -H(S%W)\S(W),Z'') (67) 
n n n 



>Y,Ro-^n- -H{S\W) \S{W), Z") (68) 
= R^-'-+ Rj-lH{S'{W)\SiW),Z^) (69) 

= V R,-en + -H{S'{W))--H{S'{W)\S{W),Z'^) (70) 

> Y R^-^n (71) 
j£S(W) 

where (l68ll is due to the fact that we assumed that sum rate secrecy constraint (165|) is satisfied 
and (170|) follows from 

Y R, = Ih{S'^{W)) (72) 

which is a consequence of the fact that message sets are uniformly and independently dis- 
tributed. ■ 

Hence, it is sufficient to check whether coding scheme presented satisfies the sum rate 
secrecy constraint. 

H{Wo, 1^1, ... , Wk\Z^) = H{Wo, W,,...,Wk, Z^) - /7(Z") (73) 
= H{U^, Ul_„ X", 1^0, W^i, • • • , Wk, Z^) - H{Z^) 

- H{U^, Ul_^, X"|W^o, W^i, . . . , W^x, ^") (74) 
= if (f/r, . . . , f/^_i, X") + E{W^, W^,...,Wk.Z--\VI,..., X") - E{Z^) 

- E{Ul, Ul^^„X^\Wo, W,,...,Wk, Z^) (75) 
> if(t/r, . . . , f/]^_i, X") - /(f/r, . . . , Ul_,, X"; Z") 

- if(f/r, . . . , f/]^_i, X"|l^o, W^i, . . . , W^x, Z^^) (76) 

where each term will be treated separately. Since given f/^ = m)!, ?7^^_]^ can take 2"(^'=+i+-^'=+i) 
values uniformly, the first term is 

K-l 



H{U^, U-^„ X") = H{Ul^) + Y HmUk-i) + H{X'Vk-i) (77) 

k=2 

K K 

= nRo + nYRk + nYRk (78) 



k=l k=l 
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where the first equahty follows from the following Markov chain 



[/f [/a" ^ . . . ^ t^K-i ^ (79) 

The second term in fl76l) is 



I{U^, Ul_^, X"; Z") = /(X"; Z") + /([/f, ^Js", . . . , Z"iX") (80) 

= /(X"; Z") (81) 
< n/(X; Z) + 7, (82) 

where ( ISTI) follows from the Markov chain in ( l79l) and ( l82l) can be shown by following 
the approach devised in [2]. We now bound the third term in ( 1761) . To that end, as- 
sume that the eavesdropper tries to decode (f/", . . . , U^_i,X'^^ using the side information 
(Wo, Wi, . . . , Wk) which is equivalent to decoding (^i, . . . , Wk^ . Since RjS are selected 
to ensure that the eavesdropper can decode them successively, see f l57|) . then using Fano's 
lemma, we have 

HiU^, X^\Wo, Wi, . . . , Wk, Z^) < e„ (83) 
Thus, using ([78]), ([82]) and ([83]) in ([76]), we get 



K K 

H(Wo, Wi,...,WK\Z'')>nJ2Rj+nY,^j- ^^(^5 ^) ' (84) 

i=o j=i 

K 

= Rj - en - (85) 

where ( l85l) follows from the following, see (157]) and ( l63l) . 

^i?, = /(X;Z) (86) 
i=i 

A. 1.2 Converse 

First let us define the following auxiliary random variables, 

Uk,^ = WoW, . . . WkY^-lZ^^„ k = l,...,K-l (87) 
which satisfy the following Markov chain 

Ui^i — ^ U2,i Uk-i,! — >■ Xj (Zj, Yx^i-, • • • , Vi,i) (88) 
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To provide a converse, we will show 

1 ^ 

where Uq = 0, Uk = X. We show this in three steps. First, let us write down 

H{Wo, W,,..., W,\Z^) = HiWo, Wi\Z'') + J2 H{Wk\Wo, Wi, . . . , W^-i, Z^) (90) 

k=2 

The first term on the right hand side of fl90l) is bounded as follows, 

H{Wo. Wx\Z^) < I{Wo, Wi; Y,^) - I{Wo, W,; ^") + e„ (91) 

n 

< ^ I{Wo, W,; YiAYl-\ ^r+i) - HWo, W,; Z,\Yr\ ^f+i) + (92) 
1=1 

n 

i=l 

+ I{Yl-\ Zf^,; Y,,) - I{Yl-\ Z^^,- Z,) + e„ (93) 

n 

= J2 HWo, Wu Yr\ ^r+i; n,) - I{Wo, Wu Yr\ ^r+i; + e„ (94) 

i=l 

n 

< ^ I{Wo, W,, Yr\ ^r+i; Yi,) - HWo, W,, Yr\ Z^^,- Z,) 

i=l 

+ /(Fr ^ Fi,,|l^o, W^i, n*-', ^r+i) - /(VT ^ilW^o, W^i, Yl-\ Zr+,) + e„ (95) 

n 

= J2 nWo, Wu YI-\ 1; Fi,) - /(Wq, W^i, n*"', ^f+i, ^^2" Z^) + e„ (96) 

i=l 
n 

= J] J(W^o, W^i, ^r+i, ^2"'; - ^(W^o, W,, Zf+i, Z,) (97) 

i=l 

+ I{Yr'; Y,,,\Wo, W,, Zr+i, y^i) - /(Fr^; Z,|l^o, W^, Z^^,, Y^') + e„ (98) 

n 

= J2 HWo, W,, Z^^„ Yi-^- Fi,) - I{Wo, W^i, Zr+i, Z.) + en (99) 

i=l 
n 

= I^Uix. Yl,^) - HUi,u Z,) + e„ (100) 



i=l 



where fl9Tl) follows from Fano's lemma, (|92|) is obtained using Csiszar-Korner identity (see 
Lemma 7 of [3]), fl93|) is due to the fact that 

I{Yl-\ Zr+i; Y,,) - I{Yl-\ Z^x, Z,) > (101) 
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which follows from the fact that each user's channel is less noisy with respect to the eaves- 
dropper. Similarly, (!95|) follows from the fact that 

/(Fr^; Fi,|M/o, W,, Yt\ ^f+i) - ^(>^r Zi\W,, W,, Yl', Z^^,) > (102) 

which is a consequence of the fact that each user's channel is less noisy with respect to the 
eavesdropper's channel. Finally, (|99ll is due to the following Markov chain 

y-i ^ y-i ^ (Wo, Wu Z^^,, Yi„ Z,) (103) 

which is a consequence of the fact that the legitimate receivers exhibit a degradation order. 

We now bound the terms of the summation in ( |90l) for 2 < k < K — 1. Let us use the 
shorthand notation, W^-i = (Wq, Wi, . . . , Wk-i), then 

H{Wk\Wk^i, Z") < I{Wk; Yj^lWk-i) - Z^\Wk-i) + e„ (104) 

n 

< Y,KWk\YkAWk-iX'\z:+i)-KWk\Z,\Wk-uYl-\Z^^^)+en (105) 

i=l 
n 

< Y,HWk; YkAm.i, Yl-\ Z;^i) - I{W,- Z,\W,.,, Yl\ Zf+i) 

i=\ 

+ liyi^^- Yl\ Zf+i, IVfc) - /(F-^; Yir\ Zf^^, ly^) + e„ (106) 

n 

= J2 HWk, n+l; YkAWk-u Yir\ zf+j - /(ly,, r-J; \ zf+j + 6„ (io7) 

i=l 
n 

= ^/(f/fe,.;n,^|f/fc-ii) -/(f/fe,^;^i|f^fc-M) + en (108) 

i=l 

where f ll04p follows from Fano's lemma, (llOSp is obtained through Csiszar-Korner identity, 
and (11061) is a consequence of the fact that 

/(n+i'; YkAWk-i, Y^-\ Zr^„ W,) - I(Yi^- Z,\Wk-,, Y^-\ W,) > (109) 

which follows from the fact that each user's channel is less noisy with respect to the eaves- 
dropper's channel. Finally, we bound the following term where we again use the shorthand 
notation Wk-i = (Wq, Wi, . . . , Wk-i), 
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H{Wk\Wk-i, Z^) < I{Wk] Y^\Wk-i) - I{Wk; Z^\Wk-i) + e„ (110) 

n 

< HWk; YkAWk-1, Yi,-\ Zr+i) - I{Wk; Z,\Wk-i, Y^-\ Zf+i) + e„ (111) 

i=l 

n 

< HWk; YkMk-1, Y^-\ Zf+i) - I{Wk; Z,\Wk-i, Y},-\ Z^^^ 

i=l 

+ /(X,; YkMk-1, Y^-\ Zf+i, Wk) - I{Xf, Z,\Wk-^u Y^-\ Z^_^„ Wk) + e„ (112) 

n 

= Y ^i^K, Xf, YkMk-1, Y^~\ Z,IVi) - I{Wk, Xf, Z,\Wk-i, Y^-\ Z^^ + e„. (113) 

i=l 
n 

= Y HX^■, YkAWk-1, Y^-\ Zf+i) + I{Wk; Yk,\Wk-i, Y^-\ Z^^,, X,) 

i=l 

- liXf, Zi\WK-u Y^-\ Zf+i) - I{Wk; Z,\Wk-u Y^'\ Z^^,,X,) + e„ (114) 

n 

= Y YkAWk-1, Y^-\ Zl^,) - /(X,; Z,\Wk-i, Y^-\ Zf+J + e„ (115) 

i=l 
n 

= Y HXi] YkAUk-ia) - HXi] Z,\UK-i,i) + en (116) 

i=l 

where f lllOp follows from Fano's lemma, fill II) is obtained by using Csiszar-Korner identity, 
and (11121) follows from the fact that 

I{Xf, YkAWk-u Yir\ Wk) - /(X,; Z,\Wk-i, Y^-\ Z^^,, Wk) > (117) 

which is due to the fact that each user's channel is less noisy with respect to the eavesdropper 
and (11151) is due to the Markov chain 

{Yk„ Z,) ^X,^{Wo,W,,..., Wk, Yj,-\ Z^^^) (118) 

which follows from the fact that the channel is memoryless. Finally, plugging f llOOp . (11081) 
and ffnel) into ([90]), we get 

E{W^, VTi, . . . , iy,|Z") < n ^ /(?7fc; n|f/fe-i) - nliJJ,- Z), l = \,...,K (119) 

fc=i 

where Uq = (j) and Uk = X, and this concludes the converse. 
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A. 2 Proof of Corollary [T] 

First, we note that 

I 

I{U,- Z) = I{U,, ...,Ue;Z) = Y, HUk, Z\Uk-i) (120) 

fc=i 

where the first equahty is due to the following Markov chain 

Ui^...^ Uk-1 -^X (121) 

By plugging fll20p into ([5]), we get 

t I 



k=l k=l 



Ro + J2Rk<Yl "^k\Uk-i) - nw, z) (122) 

k=l 

^ liUk, Yk\Uu-i) - HUk, Z\Uk-i) (123) 

k=l 

e 

J2 HUk, Yk, Z\Uk-i) - I{Uk; Z\Uk-i) (124) 

k=l 

e 

J2HUk;Yk\Uk-uZ) (125) 



fe=i 



where fll24p follows from the fact that the channel is degraded, i.e., we have the following 
Markov chain 

^Uk^Yk^Z (126) 
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B Proofs of Theorem [2] and Corollary [2] 
B . 1 Proof of Theorem H 

Achievability of these rates follows from Proposition 2 of [9] . We provide the converse. First 
let us define the following random variables, 

= (Z^, ...,Zl,) (127) 
y," = (lTi,...,nV) (128) 
^i+i = • • • 5 ^M,i+i) (129) 

= (y^i' ■ ■ ■ ,y^i) im 

Yk{z) = {Yki{z),...,YkM{t)) (131) 
Z{t) = {Z,{t),...,ZMit)) (132) 

where Y^f^ = (Yfe^l). • • • , 1^/(^-1)), = (^z(i + 1), • • • , ^/(n)). Start with the definition, 

HiWolZ'^) = H{Wo) - I{Wo; Z^) (133) 
< I{Wo; Ffc") - /(W^o; Z") + e„ (134) 

= 5^/(W^o; n(^)lFr') - /(W^o; ^(^)|^r+i) + en (135) 

i=l 

= ^ /(ivo, ^r+i; n(oi>;'-') - /(^m; n(oin'-', w^o) 

- I{Wo, Y^~\ Z{z)\Z^^,) + I{Yl-'- Z(i)\Zl^,, W,) + e„ (136) 

n 

= Y,KWo.Z^^,-Yu{i)\Yl-')-I{Wo,Yl-^-^Z{i)\Z^^,) + t^ (137) 

i=l 
n 

= J2 mo; Y.mr, z-^,) + i{z-^,- Y,{i)\Yi-') 

i=l 

- i{Wo; ^(^)i^r+i, yir') - Kyi-'-, ^(oi^m) + [m 

n 

= Y,HWo;ykmYr,Zr^,)-I{Wo;Z{z)\Zt,,,Y^-') + e^ (139) 

i=l 

where (11371) and (11391) are due the following identities 

n n 

^ I{Zr^,- Y,(z)\Y^-\ Wo) = J2 ^(n^"'; Z(z)\Z^^„ Wo) (140) 

i=l i=l 
n n 

5^/(ziv,;n(z)iFri) = $^/(rr^z(^)|zr^,) (mi) 



i=l i=l 
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respectively, which are due to Lemma 7 of [3]. Now, we will bound each summand in (11390 
separately. First, define the following variables. 



U,, = {Z-^„Y^-') (142) 

n'"'w = (143) 

ZtU^) = {Zl+,{^),...,ZMi^)) (144) 

Hence, the summand in (11391) can be written as follows, 

I{Wo-,Y,(z)\Y^-\Z-_,,)-I{Wo-,Z(z)\Zr^,,Y^~^ (145) 
= I{Wo; Y,{t)\Uk,i) - HWo; Z{i)\Uk,) (146) 
= I{W,- Yui{i), YkM{t)\Uk,) - I{Wo; Z,{t),..., ZM{i)\Uk,i) (147) 

M 

= J]/(W^o;nKO|f^M,n'"'(0) - W;^K^)|t^M,^m(0) (148) 
1=1 

M 

= HWo, z^tM, YM{i)\Uk„ Yl-\i)) - i{z^U^y, Y^iizm,, Y'-'ii). W,) 

1=1 

- I{Wo, Yt\i)■,Zl{^)\Uk,, ZflS)) + IiYl-\^-Zi{i)\Uu,. Zj^U^), Wo) (149) 

M 

= ^ I{Wo, Z^Mykiimk,, Yl-\i)) - /(PFo, Yl^'ii): Zi{z)\U,„ Z^lS)) (150) 
1=1 

M 



1=1 

I{Yt\t); Zi(t)\Uk„ Z^U^) - I{Wo; Zi{{)\U,,, Zf^i), Yl-\i)) (151) 



M 



= J2 nWo; YUmk,, Yl-^{^). ZflS)) - /(W^o; Zi{i)\U,,, Zfl,{t)X-\i)) (152) 
1=1 

where (11501) and (11521) follow from the following identities 

M M 

Y,I{Z^l,{i)-Y,i{i)\Uu,,Yl-^{i),Wo) = Y,KYl-\i)-.Zi{i)\U,,,Z^l^{i),Wo) (153) 
1=1 1=1 

M M 

Y.I{ZtlMYumk,.Yl~\i)) = Y.I{Yl-^^)-Z,{i)\Uk,,ZfUi)) (154) 



1=1 



respectively, which are again due to Lemma 7 of [3]. Now, define the set of sub-channels, 
say iS(fc), in which the fcth user is less noisy with respect to the eavesdropper. Thus, the 
summands in (11521) for I ^ S{k) are negative and by dropping them, we can bound (I152p as 
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follows, 

< I{W,-,Y,i{m,,,Yl-\^,Z^U^) - I{W,-Zi{^^^^ (155) 

l&S{k) 

Moreover, for I & S{k), we have 

IiUk,i,Yl-\t),Z^M,yki{^)-HUk,,Yl-\t),Z^^^^^^^ > 

(156) 

IiXiit);Ykiit)\Uk,i,Yl-\t),ZtU^,Wo)-IiX,it^^^ > 

(157) 

where both are due to the fact that for / G S{k), in this sub-channel the fcth user is less noisy 
with respect to the eavesdropper. Therefore, adding fll56p and (11571) to each summand in 
(11551) . we get the following bound, 

I{Wo; Y,{^\Y^-\ Z-^,) - /(W^o; ^(^)|^r+i, YIt') 

< J2 HXi{z),Wo,Uk,,Yt\i),ZlU');Yki{i))-I{Xi{{),Wo,U^^ 
ies{k) 

(158) 

= J2 ^(Mi); Ykii^) - HM^); Zi{i)) (i59) 

ies{k) 

where the equality follows from the following Markov chain 

{Wo,Uk„Yl-\i),Z^_l,{t)^ ^Xi{t) ^ {YM{^),Zl{^)) (160) 

which is a consequence of the facts that channel is memoryless and sub-channels are inde- 
pendent. Finally, using (11591) in (I139p . we get 

n 

1=1 ies{k) 

<nJ2 ^^^h Yki) - I{Xi- Zi) + e„ (162) 

M 

= n 5^ [/(X,; Yu) - I{Xf, Zi)f + e„ (163) 
1=1 

which completes the proof. 
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B.2 Proof of Corollary H 

We need to show that (fT6l) reduces to ( fTTj) for parallel degraded multi-receiver wiretap 
channels. Consider the kth user. If in the Ith sub-channel, eavesdropper receives a degraded 
version of the kth user's observation, i.e., if the Markov chain in (|TT1) is satisfied, then we 
have 

[I{Xf, Ym) - I{Xu Zi)]^ = I{Xf, Yku Zi) - I{Xu Zi) = I{Xu Yu\Zi) (164) 

where the first equality is due to the Markov chain in ffTTl) . On the other hand, if in the /th 
sub-channel, the fcth user receives a degraded version of the eavesdropper's observation, i.e., 
if the Markov chain in ( |T2|) is satisfied, then we have 

{I{Xi- Yu) - I{Xi- Zi)\^ = [I{Xr, Ym) - I{Xr, Zi, Yki)f = = I{Xr, Yu\Zi) (165) 

where the first equality is due to the Markov chain in (fT2l) . 



C Proof of Theorem 3 



Achievability of Theorem [3] is a consequence of the achievability result for wiretap channels 
in [3]. We provide the converse proof here. We first define the function p{l) which denotes 
the index of the strongest user in the /th subchannel in the sense that 



I{U-Y,,{)<I{U-Y,^^^)i) (166) 

for all U ^ Xi ^ (Yii, . . . ,Yki, Zi) and any k G {1, . . . , K}. Moreover, we define the 
following shorthand notations 



yn 






/ = 


1,.. 


.,M 


(167) 


yn 




yn\ 
' ^ Ml 








(168) 




= O^kli ■ ■ 


) Yku)-! 


k = 


1,- 


.,K 


(169) 




= (zr,... 


5 Zm) 








(170) 


V'i-l 

^k 




• • 5 -' fcM ^ 


k = 


1,.. 


.,K 


(171) 




= {z\-\. 


• • ) ^M^) 








(172) 


-'i+l 




• • • 5 ^M,i+l) 








(173) 




= {Ykiii). 


• • • ,yfc,/-l(0)> 


I 


= 1, 


...,M 


(174) 




= (^i(^), 


• • ,^i-l(0), 


I = 


1,.. 


.,M 


(175) 






,...,nf(^)), 


I = 


1,. 


.,M 


(176) 
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We first introduce the following lemma. 

Lemma 2 For the parallel multi-receiver wiretap channel with less noisiness order, we have 

I{Wu.Y^)<I{Wk;Y-), k = l,...,K (177) 

Proof: Consecutive uses of Csiszar-Korner identity [3], as in Appendix IB.lt yield 

n M 
i=l 1=1 

-I{W,; Yi{t)\Yr, Y-„ n'^'W, ^m(O)] (178) 

where each of the summand is negative, i.e., we have 

I{W,;YUWr,y^'liX-\^.Y,'^ii^)-I{W,^^^^^^^ < (179) 

because Yi{i) is the observation of the strongest user in the Ith sub-channel, i.e., its channel 
is less noisy with respect to all other users in the Ith sub-channel. This concludes the proof 
of the lemma. ■ 
This lemma implies that 

H{Wk\Y^) < H{Wk\Y^) < en (180) 
where the second inequality is due to Fano's lemma. Using fllSOp . we get 

K 

H{W,, WkIY'^) < J2 H{Wk\Y^) < Ken (181) 

k=l 

where the first inequality follows from the fact that conditioning cannot increase entropy. 
We now start the converse proof. 

H{Wu ...,Wk\Z^)< I{Wi, ...,Wk; Y^) -I{W,,..., Wk, Z^) + Ken (182) 

n M 
i=l 1=1 

-liW,, ...,Wk; Ziii)\Z^-\ Z'-\^), ^m(^))] + Ken (183) 

where (I182p is a consequence of (11811) and (11831) is obtained via consecutive uses of the 
Csiszar-Korner identity [3] as we did in Appendix IB.li We define the set of indices S such 
that for all / G S, the strongest user in the /th sub-channel has a less noisy channel with 
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respect to the eavesdropper, i.e., we have 



I{U;Y,{t))>IiU;Ziit)) 



(184) 



for all U {Yi{i), Zi{i)) and any / G S. Thus, we can further bound fll83p as 

follows, 

n 

H{w,, ...,WK\zn<Y.Yl [a^I' • • • ' nil, Z'-\i), 

i=i les 

-I{W,, ...,Wk; Zi{i)\Z''\ Yl[,, Z'-\i), y^f,(0)] + Ker, (185) 

n 

^ E E [^(^1' • • • ' z'-\^, U^) 

i=i les 

-/(M/i, ...,Wk, Z^-\ YlXr^ Z'-^{%), y^^i(2); ZKO)] + i^e„ (186) 

n 



i=\ les 



-/(X,(z), VTi, . . . , ly,,, Yll„ Z'-\t), Yil{{z); Zi(i)) 



n 

J]5^[/(X,(.);y^(.))-/(X,(.);Z,(0) 



i=l l&S 



(187) 
(188) 



where (11851) is obtained by dropping the negative terms, f ll86l) -( |T871) are due to the following 
inequalities 



I{Z^-\ YIX,. ^'-^(0, YltS)\ Yi{i}) > I{Z^-\ Y-,, Z^-\i), llf,(.); Z^ 



(189) 



I{Xi{i); Yi{i)\W^,..., Wk. Z^~\ Y'^^^, Z'-\i), r,fi(z)) > 

I{X,{i)- Zi{i)\W^,..., Wk. Z^-\ Yll,, Z'-\i), F,fi(2)) (190) 

which come from the fact that for any / G 5, the strongest user in the /th sub-channel has a 
less noisy channel with respect to the eavesdropper. Finally, we get fll88p using the following 
Markov chain 



(1^1, ... , Wk, Z^-\ YJX,^ Z'-^ii), y^^\(0) ^ Xi{{) ^ {Yu Ziii)) 



M 



(191) 



which is a consequence of the facts that channel is memoryless, and the sub-channels are 
independent. 
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D Proofs of Theorems [4] and [5 



D.l Proof of Theorem [4] 

We prove Theorem H] in two parts, first achievability and then converse. Throughout the 
proof, we use the shorthand notations = {¥{[, y^'^), = (l^i, Y^^), = (Z^, Z^). 



D.1.1 Achievability 

To show the achievability of the region given by (!28l) - (!33ll . first we need to note that the 
boundary of this region can be decomposed into three surfaces as follows [24]. 

• First surface: 

Ro<I{U2;Yu\Z2) (192) 

R2<I{X2;Y22\U2,Z2) (193) 

Ro + Ri< /(Xi; Yu\Z,) + I{U2; Y.^lZ^), U, = <P (194) 



• Second surface: 

Ro < I{U,;Y2i\Z^) (195) 

R,<I{X^■Yu\U^,Z^) (196) 

Ro + R2< I{X2; Y22\Z2) + I{Ui; Fsil^i), U2 = <p (197) 

• Third surface: 

i?o < I{Ui- Yi^\Z^) + /(f/2; Yi2\Z2) (198) 

i?o < I{Ui- Fsil^i) + /(f/2; Y22\Z2) (199) 

i?i</(Xi;rn|t/i,Zi) (200) 

R2<I{X2;Y22\U2,Z2) (201) 

We now show the achievability of these regions separately. Start with the first region. 
Proposition 1 The region defined by f ll92p -( fTMl) is achievable. 
Proof: Fix the probability distribution 

p{xi)p{u2)p{x2\u2)p{yi, 1/2, z\x) (202) 

Codebook generation: 

• Split the private message rate of user 1 as i?i = i^n + Ri2. 
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• Generate 2"'(^"+^") length-n sequences Xi through p(xi) = 11"=! ^'(^i:*) index 
them as Xi(t(;ii,^Z;ii) where Wu e {l,...,2"^"} and Wn e |l, . . . , 2"^^" |. 

• Generate 2"'^'^o+'^i2+Ri2) icngth-n sequences U2 through p(u2) = YYi=iPi^'2,i) index 
them as U2(wo, W12, W12) where wq e {l, . . . , 2"^°}, G {^1, . . . ,2"-^^^^ and G 
|l,...,2"^i2| 

• For each U2, generate 2"'(^2+ii2) length-n sequences X2 through p(x2|u2) = YYi=iP{^2,i\u2,i] 
and index them as X2(u'2, W2, wo, W12, W12) where W2 & {l, ■ ■ ■ , 2"^^}, W2 G |l, . . . , 2"-^2| 

• Furthermore, set the confusion message rates as follows. 

Rn = I{X,;Z,) (203) 
Ri2 = I{U2; Z2) (204) 
R2^I{X2;Z2\U2) (205) 



Encoding: 

If (^0,^11,^12,^2) is the message to be transmitted, then the receiver randomly picks 
(wii, ^12, ^1^2) and sends the corresponding codewords through each channel. 

Decoding: 

It is straightforward to see that if the following conditions are satisfied, then both users 
can decode the messages directed to themselves with vanishingly small error probability. 

Ro + R12 + R12 < I{U2] Y^2) (206) 
i?ii + ^ii</(^i;yii) (207) 

i?2 + ^2 < /(^2;1^22|C/2) (208) 

After eliminating i?ii and R12 and plugging the values of i?ii, i?i2, i?2, we can reach the 
following conditions, 

Ro<I{U2;Y^2\Z2) (209) 

R2<I{X2;Y22\U2,Z2) (210) 

Ro + Ri< I{X,; Filial) + I{U2; ^121^2) (211) 

where we used the degradedness of the channel. Thus, we only need to show that this coding 
scheme satisfies the secrecy constraints. 

Equivocation computation: 
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As shown previously in Lemma [T] of Appendix IA.lt checking the sum rate secrecy condi- 
tion is sufficient. 

H{Wo, Wi, VTal^") = HiWo, Wi, W2, Z") - H{Z'') 

= H{Wo, W,, W2, U^, XI Xf, Z") - H{U^\ XI X{^\Wo, W,, W2, Z^) - H{Z^) (212) 
= H{U^, X^, Xf) + H{Wo, Wi, W2, Z'^IU^, X^, ) - 

- H{U^, X^, Wo, W,, W2, Z") (213) 
> H{U^,XIX'^) + H{Z^\U^,XIX^) - H{Z^) ~ H{U^,XlX^\Wo,WuW2,Z^) (214) 

We treat each term in fl214p separately. The first term in (12141) is 

H{Ul XI = HiU^, X2") + if (Xn (215) 
= n{Ro + Rn + R2 + R12 + Rn + R12 + R2) (216) 

where the first equality is due to the independence of ([/^, X^) and X", and the second equal- 
ity is due the fact that both messages and confusion codewords are uniformly distributed. 
The second and the third terms in (I214p are 

i^(Z") - HiZ^'lU^, X2", Xf ) = H{Z''^, Z'^) - H{Z"p^, X2", X^) (217) 

< HiZ^) + HiZ^) - H{Zl, Z^IUIXIX^) (218) 
= if(Zi") + H{Z:^) - HiZ"^, Z^\X'^, Xf) (219) 
= H{Zl) + H{Z:^) - H{Zl\X'^) - H{Z:^\X^) (220) 
= /(Xf; Z^) + I{X^; Z^) (221) 

< n/(Xi; Zi) + n/(X2; Z2) + 7i,n + 72,n (222) 

where the equalities in f l219p and (12201) are due to the following Markov chains 

U^^X^^iX^,ZlZ^) (223) 
Z^ X2" Xf ^ Z^ (224) 

respectively, and the last inequality in (12221) can be shown using the technique devised 
in [2]. To bound the last term in fl214p . assume that the eavesdropper tries to decode 
{U2,X2,X'") using the side information Wq,Wi,W2 and its observation. Since the rates 
of the confusion codewords are selected such that the eavesdropper can decode them given 
Wq = Wq, Wi = Wi, W2 = W2 (see (12030 - (12050 ). using Fano's lemma, we get 

H{U^,X^,X^\Wo,WuW2,Z'') < en (225) 
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for the third term in fl2TD . Plugging fl2T6D . (1222D and (1225|1 into ([2T1D, we get 



H{Wo, W,, W2\Z^) > n{Ro + Ri + R2) - e„ - 7i,n - 72,n (226) 

which completes the proof. ■ 

Achievability of the region defined by (I195l) - fll97p follows due to symmetry. We now show 
the achievability of the region defined by fll98p -( l20Tl) . 

Proposition 2 The region described by fll98p -( l20Tl) is achievable. 
Proof: Fix the probability distribution as follows, 

p{ui)p{xi\ui)p{u2)p{x2\u2)p{yi,y2,z\x) (227) 

Codebook generation: 

• Generate 2"(^"+^oi) length-n sequences Ui through p(ui) = nr=iP(^i.«) index 
them as w.i{wq, Wqi) where i^o G {l, • • • , 2"'^o}, Wqi G |i, . . . , 2"'^''i|. 

• For each Ui, generate 2'^'^^^^^^'> Xi(wo, Woi, "U^i, "U^i) length-n sequences Xi through 
P(xi) = Yri=iP{xi^i\ui,i) where Wi G {l, . . . , 2"^i}, Wi G |l, . . . , 2"«i}. 

• Generate 2"*^^"+^°^) length-n sequences U2 through p{\i2) = YYi=iPi^'2,i) and index 
them as U2{wo, wq2) where i^o G {l, . . . , 2"^°}, wq2 G |i, . . . , 2"'^''2|_ 

• For each U2, generate 2"(^2+-R2) x2(wo, '?Z'02, "^2, W2) length-n sequences X2 through 
Pi^2) = UtlPi^2,iW2,^) where ^2 G {l, . . . , 2"^^}, ^2 G |l, . . . , 2"^^}. 

• Moreover, set the rates of confusion messages as follows. 



Roi = I{Ui;Z,) (228) 

^02 = I{U2; Z2) (229) 

i?i = /(Xi;Zi|f/i) (230) 

R2 = I{X2]Z2\U2) (231) 



Encoding: 

Assume that the messages to be transmitted are {wo^wi^W2)- Then, after randomly 
picking the tuple (wqi, ^02, "U^i, ^2), corresponding codewords are sent. 

Decoding: 
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Users decode wq using their both observations. If wo is the only message that satisfies 



= {3^;oi : (ui(«;o, *oi), y.i) e A:} (232) 

E^^° = {3^02 : (u2(wo, ^i;o2), yi2) e A^} (233) 

simultaneously for user i, Wo is declared to be transmitted. Assume Wq = 1 is transmitted. 
The error probability for user i can be bounded as 

Pr (E,) < Pr {{El El,)') + Pr {Ef,, E^^ (234) 

using the union bound. Let us consider the following 

Pr {Ef^ = Pr {3woi : (ui(j, Woi), ya) e A^) (235) 

<Y,Pi{{m{j,woi),yn)eA:) (236) 

^ 2"'^oi2-"(^('^i;^ii)-'^") (237) 

_ 2n{Roi-IiUv,Yn)+en) (238) 

Similarly, we have 

Pr {Ef,) < 2''(^°2-/(c/2;yi2)+e„) ^239) 
Thus, the probability of declaring that the jth message was transmitted can be bounded as 

Pr {Ei Ef^ = Pr {Ef^ x Pr {E^^ (240) 

^ 2"(-^i~-'^('^i;^<i)+^") X 2^^^°'^~^^^'^''^'''^^'^^"^ (241) 

_ 2'^(^oi-I(Ui;Yii)+Ro2-I{U2;Yi2)+2en) (242) 

where the first equality is due to the independence of sub-channels and codebooks used for 
each channel. Therefore, error probability can be bounded as 

Pr (Ej) < + ^ 2'*(-^i~"-^('^i'^*i)+'^2-/(t/2;yi2)+2e„) (^243) 

— en + 2"(^°+-^i~-^('^i'^*i)+'^°2-J(t/2;Yi2)+2e„) (244) 

which vanishes if the following are satisfied, 

Ro + Roi + Ro2<I{Ui;Ya) + I{U2;Y^), i = l,2 (245) 
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After decoding the common message, both users decode their private messages if the rates 
satisfy 

Ri + Ri<I{Xi;Yii\Ui) (246) 
R2 + R2<I{X2;Y22\U2) (247) 

After plugging the values of ^01,^02,^1,^2 given by fl228D - fl23T|) into fl245|) - fl247j) . one can 
recover the region described by fll98p - fl201l) using the degradedness of the channel. 

Equivocation calculation: 

It is sufficient to check the sum rate constraint, 

H{Wo, W^, W2\Z^) = H{Wo, W^, W2, ^") - //(^") 

= H{Ul f/2", XI XI Wo, W^, W2, Z^) - //(f/f, U^, Xf, X^\Wo, W,, W2, Z") 

- H{Z'') 

= //(f/f, U^, , X2") + H{Wo, Wi, W2, Z^'IU^, U^, , X2") - /f(Z") 

- H{U^, U^, Xf, X^\Wo, Wi, W2, Z") 
> H{U^, U'^\ Xl\ X2") + H{Z''\Ul\ U^, Xf , X2") - HiZ"") 

- H{U^, U^, XI X^\Wo, W,, W2, Z") 

where each term will be treated separately. The first term is 

H{U^, U^, Xf , X2") = HiU"^, U^) + H{X^\U^, U^) + //(Xf |f/f , U^) (252) 
= n{Ro + R1 + R2 + Roi + R02 + Ri + R2) (253) 

where we first use the fact that X" and X^ are independent given (f/",f/^) and secondly, 
we use the fact that messages are uniformly distributed. The second and third term of (12511) 
are 

H{Z'') - H{Z''\Ul\ U^', Xl\ X2") = H{Zl\ Z2") - ff(Zi"|Xn - H{Z'^\X'^') (254) 

< H{Zl') + H{Z1^) - H{Z^\Xl') - H{Zl'\X'^') (255) 
= /(Xf; ZD + /(X2"; Z^) (256) 

< nJ(Xi; Zi) + nI{X2; Z2) + 7i,n + l2,n (257) 

where the first equality is due to the independence of the sub-channels. We now consider 
the last term of (12511) for which assume that eavesdropper tries to decode ([/", [/^,X",X2) 
using the side information {Wq, Wi, W2) and its observation. Since the rates of the confusion 
messages are selected to ensure that the eavesdropper can decode (t/f , [/^, Xj^, X^) given 
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(248) 
(249) 
(250) 
(251) 



(Wo = Wo, Wi = wi, W2 = W2) (see fl228p - fl23ip ). using Fano's lemma we have 

H{U^',U,\X^,X^\Wo,W,,W2,Z'') < en (258) 
Plugging (I253D . (12571) and (12581) into (l25T]) . we have 

HiWo, W, Wsl^") > n(/?o + ^1 + R2) - en - 7i,n - 72,n (259) 
which concludes the proof. ■ 

D.1.2 Converse 

First let us define the following auxiliary random variables, 

Ui,i = WoW^rmx^Zl^^x (260) 

= VToW^i^^sl^^aa-'^s.+i (261) 

which satisfy the following Markov chains 

(Xu,i, ^21,15 Zi^i) (262) 

U2,i ^2,j (Xl2,i, ^22,4, ■Z'2,i) (263) 

We remark that although Ui^i and t/2,i are correlated, at the end of the proof, it will turn out 
that selection of them as independent will yield the same region. We start with the common 
message rate, 

HiWolZ"") = H{Wo) - I{Wo; Z") (264) 

< I{Wo; n") - /(Wo; Z") + e„ (265) 
= /(Wo;Fi"|Z") + e„ (266) 
= /(Wo; Y,l\Z^) + /(Wo; Y,\\Y,l, Z") + e„ (267) 

< /(Wo, Wi; Fi^^l^") + ^(W^o, W^2; ^"1^2, + en (268) 

where (I265P is due to Fano's lemma, equality in (I266P is due to the fact that the eavesdrop- 
per's channel is degraded with respect to the first user's channel. We bound each term in 
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(12681) separately. First term is 

n 

I{Wo,W,;Y;',\Z^) = Y,HWo,W,;Y,,,\YI^\Z^,Z^) (269) 

i=l 
n 

= Y,H{YuAyu\Z'^,Z^) - H{YuAYl2\ZlZlWo,Wi) (270) 
1=1 

n 

< Y,H{YuAZ2,i) - H{YuAyi2\Zl\Zl\Wo,W,,Y^[,Y^^') (271) 

i=l 
n 

= J2 H{yi2AZ2,) - HiYuAWo, Wi, Y^\, Yi^\ Z^,^,, Z^,) (272) 

i=l 

n 

= J2^iU2/, Yu,\Z2,i) (273) 



i=l 



where (12711) follows from the fact that conditioning cannot increase entropy and the equality 
in (12721) is due to the following Markov chains 

Zi ^ ^ (W,, ^2^2, Zl^, Y^) (274) 

y/^^zr 1 - yi2' ^ (w^o, w^i, yi2,u zi,, z^) (275) 

both of which are due to the fact that sub-channels are independent, memory less and de- 
graded. We now consider the second term in (I268p . 

n 

I{Wo,W2;Y,\\Y,l,Z-) = Y,I{Wo,W2;Yn,i\Y{^„Z^,ZlYir') (276) 

i=l 

n 

= J2 HWo, W2; YuAY^^, Zl,^„ Z,,) (277) 

i=l 

n 

< J2HWo,W2,Y,l,YI^\Zl^^,;YuAZi,i) (278) 
1=1 

n 

= J2HUi,i;YuAZi,^) (279) 

i=l 

where (12771) follows from the following Markov chains 

^2 ^ ^2 ^ {Wo, W2, y/fS Z^, Fn,) (280) 
Zr' ^ ^ (Wo, W2, n"2, ^iVi, Z^„ Yn,i) (281) 

both of which are due to the fact that sub-channels are independent, memoryless and de- 
graded. Plugging (12731) and (12791) into (12681) . we get the following outer bound on the 
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common rate. 



H{Wo\Z^) < ^/(f/2,^;ri2,.|Z2,.) + ^/(f/i,.;yiM|Zi,)+e„ (282) 



i=l 1=1 



Using the same analysis on the second user, we can obtain the following outer bound on the 
common rate as well. 

n n 

H{Wo\Z^)<Y,HU2,i-,Y22,\Z2,) + Y,HU,x,Y2i,\Z^,) + en (283) 

i=l i=l 

We now bound the sum of independent and common message rates for each user, 

H{Wo, Wi\Z'') < I{Wo, Wi- Yl') - I{Wo, Wi- Z^) + e„ (284) 

= I{Wo,W^;Y^\Z^) + en (285) 

= /(W^o, W,- Y^^\Z^) + e„ (286) 

= I{Wo, Wv, Y,l\Z^'') + I{Wo, W,; Yll\Y,l, Z") + e„ (287) 

where f l284p is due to Fano's lemma, (12850 is due to the fact that the eavesdropper's channel 
is degraded with respect to the first user's channel. Using f l273p . the first term in f l287p can 
be bounded as 

n 

I{Wo,Wi;Y{^\Z'') < 5^/(f/2,.;Fi2,.|Z2,.) (288) 

1=1 

Thus, we only need to bound the second term of ( 1287p . 

nWo, W,- Y^,\Y^^, Z-) = i/(rril>^2, Z^) - H{Y,\\Y,l Z^ Z^ Wo, W,) (289) 

< H{Y,^,\Z^) ~ H{Y{{\Y,l,Z^,ZlWo,W,,X^) (290) 
= iJ(ri1|Zi") - /7(171|Zi", ) (291) 
= I{X^;Y;{\Z'^) (292) 

n 

< Y,H{Yn,\Zi,) - H{YnAZl\Xl\YI,-') (293) 

i=l 
n 

= Y^HiYnAZi,) - i/(yii,i|Zi„Xi,) (294) 

i=l 
n 

= J2HXl,i■,Y^l^^\Zl,,) (295) 



i=l 
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where (I290p is due to the fact that conditioning cannot increase entropy, (12910 is due to the 
following Markov chain 



{Y^„ ZD ^ XI ^ ^2 , W^o, W^i) (296) 

and (12931) follows from the fact that conditioning cannot increase entropy. Finally, (12941) is 
due to the fact that each sub-channel is memoryless. Hence, plugging (12881) and (12951) into 
(12871) . we get the following outer bound. 

n n 

H{Wo,Wi\Z^) < X;A^m;>'imI^m) +5^ A^2,i;n2,.|^2,^) + en (297) 

i=l 1=1 

Similarly, for the second user, we can get the following outer bound, 

n n 

H{Wo, W2\Z^) < ^(^2,.; Y22AZ2,i) + Yl ^^Uix, Y2iAZr^i) + e„ (298) 

i=l i=l 

We now bound the sum rates to conclude the converse, 

H{Wq, Wi, W^sl^") = H{Wq, VTi, W2) - /(VTo, Wi, W2\ ^") (299) 
< J(l^o, W^i; Yx) + Y^\W^, W^) - J(l^o, W^i, W^2; ^") + en (300) 

= /(IVo, W^i; + K,lW^o, W^i, ^") + en (301) 

= /(w^o, w^i; ^2!^") + w^i; 1^", ^2) + Aw^2; y:^^\w^, w^, z^ 

+ 1(1^2; 1^22|W^o, W^i, 1^2") + en (302) 

= /(VTo, 1^1, K,"; ^2!^") - Wi; nsiw^o, w^i, ^") + /(w^o, 1^1; ^2) 

+ J(H^2; ITilW^o, W^i, ^") + /(H^2; >^22|W^0, W^i, >^2") + en (303) 
= Si - S2 + S3 + S4 + S5 (304) 

where (I300p follows from Fano's lemma, (13011) is due to the fact that the eavesdropper's 
channel is degraded with respect to both users' channels, (I303P is obtained by adding and 
subtracting S2 from the first term of (I302p . Now, we proceed as follows. 

S4 - S2 = /(1^2; >Ti|W^o, W^i, Z^) - I{Y2\; n2|W^o, W,, Z^ (305) 
< I{W2, Y^^; F^llW^o, W^, Z^) - I{Y^^- |W^o, W^i, (306) 
= I{W2, Y^^\Wo, VTi, Z^ yi"2) (307) 
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Adding S3 to fl307Il . we get 



S3 + S4 - S2 < I{Wo, W,; Y{[\Z^, Y,l) + I{W2; Y,\\Wo, W^, Z", Y^',) (308) 

< liWo, Wv, Y.WZ'^, + Y,l Y,\\Wo, W,, Z", Y,l) (309) 
= nWo, Wv, Y^,\Z\ Y,l) + IiW2; Y,\\Wo, Wi, Z\ Y^',) 

+ I{W2; Y,\\Wo, W,, Z", Yii) (310) 

= liWo, VTi, Y,\\Z\ y,"2) + I{W2; Y,\\Wo, W,, Z^ y,"^, Yii) (311) 

where the second term is zero as we show next, 

IiW2;Y,-,\Wo,WuZ-,Y,l,Y,-,) 

= HiW2\Wo, W,, Zl Zl Y,% Y,\) - HiW2\Wo, W^, Z^ Z^ Y^^, Y^^, Y^^) (312) 

= E{W2\W^, W^i, Y^^, F1I) - H{W2\W^, W^, ^"2, Y,X) = (313) 

where we used the following Markov chain 

(w^o, M^i, W2) ^ (rri> ^2) ^ (>Ti, ^2 ) (314) 

which is a consequence of the degradation orders that sub-channels exhibit. Thus, (13 lip can 
be expressed as 

S3 + S4 - S2 < /(l^o, W^i, W2; Y^^\Z^, Y^^) (315) 

= /(PFo, W^i, W^2; l^r, ^2) (316) 

< /(xr, w^o, w^i, 1^2; nii^r, ^2) (317) 

= I{X^-Y;^,\Zl,Y^,)+I{Wo,Wr,W2;Y^,\Z'l,Y^,,X^) (318) 
where (I316p follows from the following Markov chain 

Z2 ^ ^2 ^ (W^o, Wi, W^2, ZD (319) 

which is due to the degradedness of the channel. Moreover, the second term in (1318^ is zero 
as we show next, 

/(iyo,vri,w^2;n"i^r,n2,^r) 

= H{W^, VTi, W2\Z^. Y,l, X^) - H{Wo, W^, W2\Z^, Y,l, Xf, Y,\) (320) 

= H{Wo,W,,W2\Y,l,X^) - H{Wo,W,,W2\Y;'2,Xr) = (321) 
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where (13210 follows from the following Markov chain 

Z^) ^ ^ {Wo, W,, W^, ^"2) (322) 

Thus, (13181) turns out to be 

S3 + S4 - S2 < /(Xf; ^"2) (323) 

which can be further bounded as follows, 

S3 + S4 - S2 < /f(ni|Zr,Fi"2) - i/(ni|Zr,yi"2,^r) (324) 

< //(nil ZD - if(riiizr,Fi"2,^r) (325) 

= i7(y^"i I ZD - (17! I ^r, ^r) (326) 

n 

<^J(Xi,;yn,|ZM) (327) 

i=l 

where (I325P is due to the fact that conditioning cannot increase entropy, (13261) is due to the 
following Markov chain 

(yi"„ZD^Xr^Fi"2 (328) 
Finally, (1327p is due to our previous result in (12950 . We keep bounding terms in (13040 . 



S5 = /(W^2; iTslW^o, ZD Z2D (329) 

= Y^,\Wo, W^i, F2", ^2 ) (330) 

n 

= Y22,i\Wo, W^i, y2i, Z^, ^22"') (331) 

i=l 
n 

= J2 Y22,i\Wo, Wu Y^^, Zl^^^, y^2"\ Z2,i) (332) 

i=l 
n 

= J]j(W^2;>22,^|f/2,^,Z2,.) (333) 

1=1 
n 

< J]/J(F22,^|f/2„Z2,) -i/(F22,^|f/2,i,Z2,i,l^2,X2,) (334) 

i=l 
n 

<^J(X2,,;r22,.|?72,„Z2,,) (335) 



j=i 
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where (13300 and (13320 are due to the following Markov chains 

Zl K,1 - (W^o, W^i, W^2, >^22, ^2 ) (336) 
Z\-^ ^ r^2"i ^ (iVo, W^i, W^2, 1^2", ^2,, ^^22,) (337) 

respectively, (I334p follows from that conditioning cannot increase entropy and (13351) is due 
to the following Markov chain 

(>^22„ ^2,) ^ ^2, ^ (1^2, ^2,^) (338) 

which is a consequence of the fact that each sub-channel is memoryless. Thus, we only need 
to bound Si in (13041) to reach the outer bound for the sum secrecy rate. 

Si = 7(1^0, W^i,K,";n2l^") (339) 

n 

= J]/(Wo, w^i,>Ti;n2,.|^r,^2",>72"') (340) 

i=l 
n 

< Y,H{YuAZ2,i) - H{YuAZ'^,ZlYI^\Wo,Wi,Y,\,Y^^') (341) 

i=l 
n 

= J2 H{Y,2AZ2,i) - H{YuAZl Yl^\ Wo, W^, Y,\, Y^,') (342) 

i=l 

n 

= Y,H{Y^2AZ2,)-H{Y^^,\Wo,W^,Y^^,Yi:^\Zl^^^,Z^.:) (343) 

i=l 
n 

= J]j([/2,,,;ri2,|^2,) (344) 



2=1 



where (I34ip is due to the fact that conditioning cannot increase entropy, (I342p and (13430 
follow from the following Markov chains 

- y21 - (W^O, W^l, >^22"', ^2, ^2 ) (345) 

(172"', ^r') ^ ^^22^' ^ (W^o, VTi, W^2, ITi, Zl,, Fis,) (346) 

respectively. Thus, plugging (I327p . (I335P and (13440 into (I304p . we get the following outer 
bound on the sum secrecy rate. 

n 

H{Wo,Wi,W2\Z'') < ^/(Xl,,;Fn,^|^l,^) + /(X2,.;r22,d^2,.,^2i) + /(?72,.;Fi2,.|^2i^ 

1=1 

(347) 
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Following similar steps, we can also get the following one 

n 
i=l 

(348) 

So far, we derived outer bounds, (12821) . (I283D . (12971) . (12981) . (IMTj) . (1348|) . on the capacity 
region which match the achievable region provided. The only difference can be on the 
joint distribution that they need to satisfy. However, the outer bounds depend on either 
p{ui,Xi) or p{u2,X2) but not on the joint distribution p{ui,U2,Xi,X2)- Hence, for the outer 
bound, it is sufficient to consider the joint distributions having the form p{ui,U2,xi,X2) = 
p{ui,xi)p{u2, X2). Thus, the outer bounds derived and the achievable region coincide yielding 
the capacity region. 

D.2 Proof of Theorem [5] 
D.2.1 Achievability 

To show the achievability of the region given in Theorem [5|, we use Theorem HI First, we 
group sub-channels into two sets Sj,j = 1,2, where Sj,j = 1,2, contains the sub-channels 
in which user j has the best observation. In other words, we have the Markov chain 

Xi ^ ^ Y21 ^ Zi (349) 

for I & Si, and we have this Markov chain 

Xi ^ Y21 ^ Yu ^ (350) 

for / e S2. 

We replace Uj with {Ui}i(=Sj, Xj with {X^jig^^,, Yji with {F^J^g^^, Yj2 with {K,7}/g525 and 
Zj with {Zi}i(=Sj,j = 1,2, in TheoremHl Moreover, if we select the pairs {{Ui, Xi)}f^^ to be 
mutually independent, we get the following joint distribution 

M 

p{{ui,xi,yii,y2i,zi}fi^) =Ylpiui,xi)p{yii,y2i,zi\xi) (351) 

1=1 

which implies that random variable tuples {{ui,xi,yii,y2i, zi)}fi-^ are mutually independent. 
Using this fact, one can reach the expressions given in Theorem |5l 
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D.2.2 Converse 

For the converse part, we again use the proof of Theorem HI First, without loss of generahty, 
we assume Si = {1, . . . , Li}, and ^2 = {Li + 1, . . . , M}. We define the following auxiliary 
random variables 



Ul^i — iyoW^2^1[Li+l:M]^l[l:Li]^[l:Li],i+l (^52) 
U2,i = WoWl^2ll-.Li]^2[Ll+l:M]^[Li+l:AI],i+l (353) 



which satisfy the Markov chains 

Ui^i — >■ X/ j {yii,i, ^2/,i, Zi^i), / = 1, . . . , Li (354) 
U2,^ Xi,^ iYu,i,Y2i„Zi,), / = Li + l,...,M (355) 

Using the analysis carried out for the proof of Theorem HI we get 

n n 

nRo < ^ I{UlX-, ^l[l:Li\,i\^[l:Li],i) + ^ 1(^2/, '^^[Li+hM] ,i | ^[Li+1:M] ,i) + (356) 
1=1 i=l 

where each term will be treated separately. The first term can be bounded as follows 

Li 



'^l[l:Li],j|^[l:Li],i) = ^ ^[l:Li],j) (357) 

1=1 
Li 

= J2 HUl/, Yu,^\Yl[l■.l-ll,^, Zyi.,L,id (358) 



1=1 

Li 



Ym\Zi^^) (359) 



1=1 

where (13581) follows from the Markov chain 



Z[l:l-l],i {Ul^i, Yii^i, Z[i,L^]^i) (360) 

which is due to the degradedness of the sub-channels. To this end, we define the following 
auxiliary random variables 

= Yi[i;i-i],iZ[i+i;Li],iUi^i, I = 1, . . . , Li (361) 
which satisfy the Markov chains 

Vi,i Xi^i {Yii^i, Y2i^i, Zi^i), / = 1, . . . , Li (362) 
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Thus, using these new auxihary random variables in 03590 . we get 



HUix, Ylll..L,],i\Z[l■.L,],^) < J2 ^(^'^5 YllAZ^) (363) 



1=1 



We now bound the second term in (13561) as follows, 

I{U2,i] Yl[Lx+l.M\,i\Z[Li+l:M],i) 
M 

= ^ HU2,i]Yll,i\Z[Li+l:M],i,yi[Li+l:l-l],i) (364) 



l=Li+l 
M 



= ^ IiU2,hyil,i\Z[l:M],i,YilL^+i.i_i]^i) (365) 
l=Li+l 
M 

< J2 H{YuAZi,i)-H{YuAZ[tMU,YiiL,+ia-iu,U2^ (366) 

l=Li+l 
M 

< H{Yii^i\Zi^i) - H{Yii^i\Zii.M],i,YiiL^+ia-i],i,U2,i,Y2iL^+id-i],i) (367) 

l=Li+l 
AI 

= ^(>^lZ,*|^Z,.)-i^(>lMl^[;:M],*,f^2,i,V'2[Li+l:;-l],0 (368) 

l=Li+l 
M 

= -^(^[i+l:Af],i, f^2,j, ^2[Li+l:i-l],i; ^l«,i|^«,i) (369) 



l=Li+l 



where (13651) follows from the Markov chain 

Z[Li+l:l-l],i Yi[Li^l:l-l],i {U2,i, Z[tM],i,Yii^i) (370) 

which is a consequence of the degradedness of the sub-channels, (13661) and (I367P follow from 
the fact that conditioning cannot increase entropy, and (I368P is due to the Markov chain 

^l[Li+l:«-l],i ^2[Li+l:«-l],j ^ (f^2,j) ■Z'[i:M],j7 ^li,j) (371) 

which is again a consequence of the degradedness of the sub-channels. To this end, we define 
the following auxiliary random variables 

Vl,i = Y2[Li+l:l-l],iZ[l+l:M],iU2,i, / = Li + 1, . . . , M (372) 

which satisfy the Markov chains 

Vi,i-^ X^^ {Yu,i,Y2i,i,Z^), / = Li + l,...,M (373) 
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Thus, using these new auxihary random variables in 03690 . we get 



M 



< I{Vix,Yu,i\Z^) (374) 



l=Li+l 

Finally, using (13631) and (I374p in (I356p . we obtain 

n M 



nRo<J2J2 ^I'.^l^'.*) + (375) 
Due to symmetry, we also have 

nRo<J2Yl "^2iAZi,) + en (376) 



i=l 1=1 



n M 



1=1 1=1 



We now bound the sum of common and independent message rates. Using the converse 
proof of Theorem HI we get 

n n 
n{Ro + Rl)<J2 ^(^[l^ii],- Yl[l:L,]AZll:L,],i) + J] HU2,i] ^[L 1 

+ en (377) 

j=i 1=1 

where, for the second term we already obtained an outer bound given in (I374p . We now 
bound the first term, 

Li 

H^[l:Li],h yi[l:Li],i\Z[l:Li],i) = ^ H^[l:Li],ii '^l/,i I ^[l:Li] ,i5 '^l[l:«-l],i) (378) 

1=1 

< ^ H{Yii^i\Zi^i) — H{Yii^i\Z\^i,L-^T^^i, yi[i:i-i],i, X[i.ij]_j) (379) 
1=1 

= J2h{Yu,\Zi,) - H{Yu,\Zi„Xi^i) (380) 
1=1 

= J2HXl,^■,yllAZl,^) (381) 



1=1 



where (I379P follows from the fact that conditioning cannot increase entropy, and fl380p is due 
to the following Markov chain 

{yil,i, Zi^i) Xi^i — > (X[i.;„i]^j, j, 2'[;+i.i^]^j) (382) 

which follows from the facts that channel is memoryless and sub-channels are independent. 
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Thus, plugging (1371) and (l38Til into (13771) . we obtain 

n n 



Due to symmetry, we also have 

n n 

n{Ro + Ri)<Y,Yl ^2i,i|^i,i) + 5^ 5^ HVi,i; Y2i,i\Zi,i) + en (384) 

i=l ie<S2 i=l iG5i 

We now bound the sum secrecy rate. We first borrow the following outer bound from 
the converse proof of Theorem HI 



n{Ro + R, + R^)<J2 HX[i-Mu; >^i[i:L,],^|^[i:L,],i) (385) 

i=l 

n n 

+ H-^lLi+l:M],u Y2[Li+l:M],i\U2,i, Z [L-^+V. M] ,i) + I{U2,i\ ^l[Li+l:M],i | ^[Li+1:M] ,i) (386) 

i=l i=l 

where, for the first and third terms we already obtained outer bounds given in (13811) and 
(13741) . respectively. We now bound the second term as follows, 

-^(-^[Li+l:M],i; ^2[Li+l:M],i|^2,i5 ^[Li+l:M],i) 

M 

= Ii^[Li+l:M],i',Y2l,i\U2,i, Z[L-^+i;M],i,y2lLi+l:l-l],i) (387) 

l=Li+l 
M 



H-^lLi+l:M],i',y2l,i\U2,i, Z[i,M],i,y2[Li+l:l-l],i) (388) 

=Li+l 
M 

HX[L,+l■.M],^■,Y2lM^^Z^^,) (389) 

=Li+l 
M 

J2 H{Y2i^Vi,,Zi,) - H{Y2i^Vi,,Zi,,XyLMi],) (390) 

=Li+l 
M 

J2 H{Y2i,\Vi,,Zi,) - H{Y2i,\Vi„Zi„Xi,) (391) 

=Li+l 
M 

J2 I{Xi,-Y2u\Vi,,Zi,) (392) 



i=Li+l 

where ( 13881) follows from the Markov chain 



Z[Li+l:l-l],i ^2[Li+l:«-l],i ^ ^^2,4, ■Z'[;;A/],j5 -^[Li+l:Af],i5 ^2«,i (393) 
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which is a consequence of the degradedness of the sub-channels, f l389p is obtained via using 
the definition of ¥2,1 given in (13721) . and fl39ip follows from the Markov chain 



(^z,j,^2i,i) Xi^i {Vi^i, X[L^^i,i_i]^i, X[i^i,M]) (394) 

which is due to the facts that channel is memoryless and sub-channels are independent. 
Thus, plugging flHTD . fl38TD and fl392l) into fl386D . we get 

n n 

n{Ro + R1 + R2) <Y,Y. "^iiAZ^) + y2iAV^, Zi,,) 

i=l i^Si 1=1 IGS2 

n 

+ $^$^/(V^,.;>^iMl^M) + en (395) 
Due to symmetry, we also have 

n n 

n{Ro + R, + R,)<Y^Y, HXi,; Y2i,\Zi,) + Y,Y1 ^i'.*'^." ^'.*) 

n 

+ J] J]/(Vl,i;>^2Ml%) + en (396) 

i=l «e5i 

Finally, we note that all outer bounds depend on the distributions p(f;,j, xi^i, yu^i, y2i,i, zi^i) = 
p{vi,i, xi^i)p{yii^i, y2i,i, zi^xi^i) but not on any joint distributions of the tuples {vi^i, x^, yu^i, y2i,i, 
zi^i) implying that selection of the pairs {vi^i,xi^i) to be mutually independent is optimum. 



E Proof of Theorem [6 



We prove Theorem [6] in two parts; first, we show achievability, and then we prove the 
converse. 

E.l Achievability 

Similar to what we have done to show the achievability of Theorem HI we first note that 
boundary of the capacity region can be decomposed into three surfaces [24]. 

• First surface: 

R<)<aI{U2;Yu\Z2) (397) 

R2<aI{X2;Y22\U2,Z2) (398) 

Ro + Ri<aI{Xi;Yn\Zi) + aI{U2;Yi2\Z2), Ui = (j) (399) 
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• Second surface: 



Ro<aI{UuY2i\Z^) (400) 
i?i <a/(Xi;yn|C/i,^i) (401) 
Ro + R2< aI{Ui; Y2i\Zi) + aI{X2] ^221^2), C/2 = (402) 



• Third surface: 



Ri<Ql{Xi;Yii\Ui,Zi) (403) 

R2<aI{X2]Y22\U2,Z-,) (404) 

Ro < aI{Ui; Yii\Z,) + aI{U2] 1^121^2) (405) 

i?o < a/(C/i; Y2i\Z^) + aI{U2] l22|^2) (406) 

To show the achievabihty of each surface, we first introduce a codebook structure. 
Codebook structure: 

Fix the probabihty distribution as, 

p(mi, xi)p{u2., X2)p{yi, 2/2, z\x) (407) 

• Generate 2"(-'^oi+^ii+-'^ii) length-ni sequences Ui through p(ui) = YYiliP{'^i,i) index 
them as Ui(woi, Wu, Wu) where Wqi G {1, ■ ■ ■ , 2"^°i}, wu e {1, . . . , 2"-'^"} and Wu £ 
{1,...,2"^"}. 

• For each ui, generate 2^^^'^^'^^'^^'^ length-ni sequences Xi through p(xi) = 
nr=i P(^i,j|'"i,i) s-iid index them as Xi(woi, Wn, Wn, W12, W12) where Wu G {1, . . . , 2"-^^2 

W12 e {l,...,2"«-}. 

• Generate 2"(^o2+ii2i+fl2i) length-(n - ui) sequences U2 through p(u2) = lY^Ii"^ p{u2,i) 
and index them as U2(wo2, W2i, W21) where W02 G {1, . . . , 2"^°^}, W21 G {1, . . . , 2^^^^} 
and W21 e {l,...,2"^2i-}. 

• For each U2, generate 2'^^^^^'^^'^^^ length- (n — n-i) sequences X2 through p(x2) = 
IYi=i^ P{x2,i\'^2,i) and index them as X2(wo2, W21, 'it'21, W22, W22) where ^22 e {1,..., 
2"-^^^}, W22 e {1,...,2"^22}. 

• We remark that this codebook uses first channel rii times and the other one {n — rii) 
times. We define 

a = — (408) 
n 

and a — 1 — a. 
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• Furthermore, we set 



R^^=aI{Ui]Zi) (409) 

Ri2 = aI{Xi;Zi\Ui) (410) 

R2i=aI{U2;Z2) (411) 

R22 = aI{X2;Z2\U2) (412) 

Ri = Rn + Ri2 (413) 

i?2 = R21 + R22 (414) 



Encoding: 

When the transmitted messages are (wqi, ^02, Wii, Wu, W21, W22), we randomly pick {wn, 
Wi2,yj2i,U!22) and send corresponding codewords. 

Decoding: 

Using this codebook structure, we can show that all three surfaces which determine the 
boundary of the capacity region are achievable. For example, if we set f/i = (that implies 
Rqi = Ru = Rii = 0) and R21 = 0, then we achieve the following rates with vanishingly 
small error probability. 

R,<aI{Xi;Yn\Z,) (415) 
Ro<aI{U2;Yi2\Z2) (416) 
R2<aI{X2;Y22\U2,Z2) (417) 

Exchanging common message rate with user I's independent message rate, one can obtain 
the first surface. Second surface follows from symmetry. For the third surface, we first set 
Ru = R21 = 0. Moreover, we send common message in its entirety, i.e., we do not use a rate 
splitting for the common message, hence we set Rqi = R02 = Ro, wqi = W02 = wq. In this 
case, each user, say the jth one, decodes the common message by looking for a unique Wq 
which satisfies 

= {3*01 : {u,{wo,woi),yji) e a:} (418) 
EJ^' = {3wo2 ■■ {u2{wo, ^;o2), y,2) e a:} (419) 

(420) 

Following the analysis carried out in (12341) - fl245p . the sufficient conditions for the common 
message to be decodable by both users can be found as 

Ro<aIiUi;Y,i\Zi) + aIiU2;Yj2\Z2), J = 1,2 (421) 
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After decoding the common message, each user can decode its independent message if 

R,<aI{X,;Yu\UuZ,) (422) 
R2<aI{X2;Y22\U2,Z2) (423) 

Thus, the third surface can be achieved with vanishingly small error probability. As of now, 
we showed that all rates in the so-called capacity region are achievable with vanishingly small 
error probability, however we did not claim anything about the secrecy conditions which will 
be considered next. 

Equivocation calculation: 

To complete the achievability part of the proof, we need to show that this codebook 
structure also satisfies the secrecy conditions. For that purpose, it is sufficient to consider 
the sum rate secrecy condition. 

H{Wo, Wi, H^sl^r, ^2"""') = HiWo, Wi, W2, Zf\ Zr"') - //(ZfS Z^"') (424) 

= H{Wo, Wi, W2, f/fs ^Js'^-^s xfs X2"-"\ ^2"-"^) - H{zi\z:^-''^) 

- /7(f/f\ f/2"-"\XfSX2"-"^|iyo, Wi, W2, ^2"""^) (425) 

- H{Z'^' , ^2"""^ ) - H{U'^^ , f/2"~"' , , ^2""''' \Wq,Wi,W2, , ^2"""' ) (426) 

- /f(Zi"\ ^2"""^) - i/(t/f \ f/2"~"\ ^2"""Wo, Wi, W2, ^2"-"^) (427) 
where each term will be treated separately. The first term is 

(f/f S [/2" , Xfl, X2"-"l ) 

= i/([/f\ t/^~"^) + H{X1^\U'^^) + H{X^"''\U^-''') (428) 
= n{Ro + Rn + Rn + R21 + R21) + n(i?i2 + R12) + n(i?22 + ^^22) (429) 
= n{Ro + Ri + R2) + niI{Xi- Z,) + {n - n{)I{X2] Z2) (430) 

where the first equality is due to the Markov chain 

^ f/f 1 ^ [/2"""^ ^ X2"""i (431) 

The equality in (14291) is due to the fact that (f/fS [/2"~"') can take 2"(^''+^"+^"+^2i+/j2i) 
values uniformly, and given t/f^ (resp. 6^2"""'), -^1"' (resp. X2"""^) can take 2"(^i2+Ri2) 
(resp. 2"*^^22"'"-^22)) values with equal probability. To reach (I430p . we use the definitions in 
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fl409l) - fl414p . We consider the second and third terms in fl427p . 

< H{Z'^^ ) + HiZ'^""^ ) - H{Zl^ , I , , , X:^-""^ ) (432) 
= ^) + H{Z^-''') - HiZ"^' iXfi) + i7(Z2"-"^ 1X2"-"^) (433) 
= J(Xf^ Zi"^) + /(X2"""^ ^2"-"^) (434) 

< ni/(Xi; Zi) + (n - ni)/(X2; Z2) + 7i,n + 72,n (435) 

where (14321) is due to the fact that conditioning cannot increase entropy, (14331) follows from 
the Markov chain 

and (14351) can be shown using the technique devised in [2]. We bound the fourth term of 
f H27l) . To this end, assume that the eavesdropper tries to decode ([/f \ XJ^^, t/g"""'. ^2"""') 
given side information (Wq = wq, Wi = wi, W2 = 102). Since the confusion message rates are 
selected to ensure that (see (l409p -( l4T2l) ) the eavesdropper can decode them as long as side 
information is available. Consequently, use of Fano's lemma yields 

H{U^\U^-''\X^\X^-'''\Wo, Wi, W2, Z'l\Z^-'^^) < en (437) 
Finally, plugging fH30|) . (14351) and (14371) into (14271) . we get 

H{W,, 1^1, l^2|^r\ ^2") > ^(^0 + ^1 + ^2) - e„ - 7i,n - 72,n (438) 
which completes the achievability part of the proof. 

E.2 Converse 

First, let us define the following auxiliary random variables, 

t/i, = W^oW^2n2""^nV'^M+i, ^ = 1, . . . , ni (439) 
U2, = W^WrY^^^Yi:,^Z'^ll, 2 = 1, . . . ,n - m (440) 

where we assume that first channel is used n\ times. We again define 

a = ^ (441) 
n 
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We note that auxiliary random variables, Ui^i, U2,i satisfy the Markov chains 



Ui, ^ Xi,, ^ (Fn,., Y2i„ Z^,) (442) 

U2,^ ^ X2,^ ^ (1^21,., >^22,., ^2,.) (443) 

Similar to the converse of Theorem HI here again, [/i j and U2,i can be arbitrarily correlated. 
However, at the end of converse, it will be clear that selection of them as independent would 
yield the same region. Start with the common message rate, 

HiWolZ^^Z^-""') (444) 

< liWo; nr"0 - HWo; Zl\ Zr"^) + en (445) 
= /(iyo;nT,nr"N^r,^2""^) + en (446) 
= I{Wq] Fi"2~"'l^rS ^2~"') + ^(^o; l^iTl^r, ^2"""'. ^12""') + en (447) 

< /(w^o,i^i;nr"N^rs^2") + w,H^2;n?i^rs^2""snr"^ (448) 



where ( I445P is due to Fano's lemma, (14461) is due to the fact that the eavesdropper's channel 
is degraded with respect to the first user's channel. Once we obtain (1448 p . using the analysis 
carried out in the proof of Theorem HJ we can obtain the following bounds. 

n—n-i 

liWo, yir"N^r, ^2~"^) < ^(^2,; 1^2,1^2,) (449) 

i=l 
"1 

/(iyo,vr2;nTl^r,^2""Sn2""^) < $^/(f/M;>^iMl^i,i) (450) 

where (1449 p (resp. (I450p ) can be derived following the lines from (I269D (resp. (12761) ) to (I273|) 
(resp. (I279P ). Thus, we have 

n—ni ni 

H{Wo\Zl\Zl^-^') < IiU2X, Yi2AZ2,i) + Y ^(^1.^' ^11.^1^1-0 + en (451) 

i=l i=l 

and similarly, we can get 

H{Wo\Zl\ZJ^-^') < Y I(U2X. Y22AZ2,i) + Y ^(^1.^' ^2i,.|^i,^) + en (452) 
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We now consider the sum of common and independent message rates, 



H{Wo,W^\Z^\Zr''') 

< I{Wo, Wv, nT, nr^O - HWo, Wi- Z^\Z^-^^) + en (453) 

= I{Wo, Wi- nr^N^rS ^2""') + en (454) 

= I{W,,Wr,Y;',-'''\Zl\Zr''')+I{W,,W,-Y^,^\Z'l'^ (455) 



where ( I453P is due to Fano's lemma, (14541) follows from the fact that the eavesdropper's 
channel is degraded with respect to the first user's channel. The first term of (I455p is 
already bounded in fl449p . The second term can be bounded as 

/(Wo,m;nTl^r,^2"'^Sn2""^) < 5^/(Xi,,;Fn,|^M) (456) 

i=l 

which can be obtained following the lines from (12890 to (I295p . Hence, plugging (1449 p and 
fH56D into fH55D . we get 

H{Wo, Zr"^) < ^(^2,.; ^2,^1^2,^) + ^(^1.*' ^11-^1^1.0 + en (457) 

i=l i=l 

Similarly, we can obtain 

n— ni n\ 

H{Wo, W^\Zl\Zl-'''') < Y Y22,\Z2,) + Y y2iAZi,) + en (458) 

i=l i=l 

Finally, we derive the outer bounds for the sum secrecy rate, 

H{Wo, w,, W2\zi\zi--^) < /(w^o, w^i; nT, nr"^) + m^. i^sT, >^22~"Wo, w^i) 

- /(PVo, W^i, W^2; Zl\Zl-^^) + e„ (459) 

= j(w^o, w^i; nT, nr^N^r, ^2 ""^) + ^sT, >^2r"Wo, w^i, ^r, ^2"^"^) + e„ (46o) 

+ 1(1^2; >^2? |W^o, Wi, Zr"^) + I{W2; Y^i'''\Wo, Wi, Z^\ Z^~^\Y^l') + e„ (461) 

= i{Wo, w,, r^T; nr^N^r, ^2 ^"■^) - /(K,i- nr^N^r, ^2 M/^o, m^o 

+ 1(1^2; 1^2r"Wo, W^i, ^2"~"S >^2?) + en (462) 
= ^1 - ^2 + ^3 + ^4 + ^5 + e„ (463) 

where in (14590 . we used Fano's lemma and (14600 follows from the fact that the eavesdropper's 
channel is degraded with respect to both users' channels. We can again use the analysis 
carried out in the converse proof of Theorem H] to bound (I463p . For example, following lines 
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from 03O5P to (132 7p . we can obtain 



ni 

S, + Ss-S2<J2 ^(^1,*; yiiAZi,i) (464) 

i=l 

Similarly, if we follow the analysis from (13291) to (13351) . we can get 

n—ni 

S,<Y, ^(^2,.; Y22,\U2„ Z,,) (465) 

i=l 

and if we follow the lines from (13391) to (13441) . we can get 

n—ni 

Si< J2liU2X,Y,2AZ2,i) (466) 

i=l 

Thus, plugging (IM . (H65l) and (M) into (H63ll . we get 

ni n— Til 

i/(lV0,W^l, W2|ZrSZr"l) < J^I{XlX,YuAZl,^) + 5Z /(f/2,.; Vl2,.|^2,^) 

i=l 1=1 
n— ni 

+ ^ I{X2,i; Y22AU2,i, Z2,) + en (467) 

i=l 

Similarly, it can be shown that 

HiWo. W^sl^r, ^2") < ^^21^1^2,.) + ^^ii.df^M, ^m) 

j=l i=l 
n— ni 

+ /(X2,.;F22,^|^2,.) (468) 

So far, we derived outer bounds on the secrecy capacity region which match the achievable 
region. Hence, to claim that this is indeed the capacity region, we need to show that 
computing the outer bounds over all distributions of the form p(ui, a;i)p(M2, X2) yields the 
same region which we would obtain by computing over all p(mi, U2, Xi, X2). Since all the 
expressions involved in the outer bounds depend on either p(mi,xi) or •p{u2-,X2) but not on 
the joint distribution p('Ui, M2, X2), this argument follows, establishing the secrecy capacity 
region. 
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